Merge branch 'dev' into ota-encryption-offer-api-key

Co-authored-by: pre-commit-ci-lite[bot] <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

.github/actions/cache-arduino8266/action.yml

@@ -1,39 +0,0 @@
-name: Cache Arduino ESP8266
-description: >
-  Resolve the pinned Arduino core and xtensa toolchain versions and cache the
-  native ESP8266 install (~110 MB framework + toolchain; no ccache store, the
-  seed job saves before any compile runs). Exports
-  ESPHOME_ARDUINO8266_PREFIX to the job so every later step installs into
-  the cached path; the Python venv must already be restored. Mirrors
-  cache-esp-idf: only dev-branch pushes write the shared cache, everything
-  else restores.
-runs:
-  using: composite
-  steps:
-    - name: Resolve the native toolchain cache key
-      # Versions are pinned in code, not a hashable file; resolve them so a
-      # bump changes the cache key. Assignment form so errexit catches a
-      # resolver failure.
-      id: version
-      shell: bash
-      run: |
-        # One owner for the install prefix: exported here and referenced by
-        # the cache steps below via env, so the caller's install and the
-        # cached path cannot diverge.
-        echo "ESPHOME_ARDUINO8266_PREFIX=$HOME/.esphome-arduino8266" >> "$GITHUB_ENV"
-        . venv/bin/activate
-        key=$(python -c 'from esphome.components.esp8266 import RECOMMENDED_ARDUINO_FRAMEWORK_VERSION as f; from esphome.arduino8266.framework import TOOLCHAIN_VERSION as t; print(f"{f}-{t}")')
-        [ -n "$key" ] || exit 1
-        echo "key=$key" >> "$GITHUB_OUTPUT"
-    - name: Cache the native toolchain (write on dev)
-      if: github.ref == 'refs/heads/dev'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ env.ESPHOME_ARDUINO8266_PREFIX }}
-        key: ${{ runner.os }}-esp8266-native-${{ steps.version.outputs.key }}
-    - name: Restore the native toolchain (off dev)
-      if: github.ref != 'refs/heads/dev'
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ env.ESPHOME_ARDUINO8266_PREFIX }}
-        key: ${{ runner.os }}-esp8266-native-${{ steps.version.outputs.key }}

.github/workflows/ci-docker.yml

@@ -197,7 +197,6 @@ jobs:
         # the default.
         id:
           - esp8266-arduino
-          - esp8266-arduino-native
           - esp32-arduino-platformio
           - esp32-arduino-esp-idf
           - esp32-idf-platformio
@@ -208,17 +207,6 @@ jobs:
           - ln882x-arduino
           - nrf52
           - host
-        # Strict by default so a new matrix id cannot silently join in the
-        # degrade-quietly mode the knob exists to catch; the knob is inert
-        # where no pch code runs (esp32-*-platformio, nrf52).
-        # Opt-outs: libretiny GCC rejects its own pch until a toolchain bump.
-        include:
-          - id: bk72xx-arduino
-            pch_strict: "0"
-          - id: rtl87xx-arduino
-            pch_strict: "0"
-          - id: ln882x-arduino
-            pch_strict: "0"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download image artifact
@@ -230,7 +218,6 @@ jobs:
       - name: Compile ${{ matrix.id }}
         run: |
           docker run --rm \
-            -e ESPHOME_PCH_STRICT="${{ matrix.pch_strict || '1' }}" \
             -v "${{ github.workspace }}/docker/test_configs:/config" \
             "ghcr.io/esphome/esphome-amd64:${{ needs.check-docker.outputs.tag }}" \
             compile "${{ matrix.id }}.yaml"

.github/workflows/ci.yml

@@ -102,8 +102,6 @@ jobs:
       device-builder: ${{ steps.determine.outputs.device-builder }}
       esp32-platformio: ${{ steps.determine.outputs.esp32-platformio }}
       esp32-platformio-components: ${{ steps.determine.outputs.esp32-platformio-components }}
-      esp8266-native: ${{ steps.determine.outputs.esp8266-native }}
-      esp8266-native-components: ${{ steps.determine.outputs.esp8266-native-components }}
       changed-components: ${{ steps.determine.outputs.changed-components }}
       changed-components-with-tests: ${{ steps.determine.outputs.changed-components-with-tests }}
       directly-changed-components-with-tests: ${{ steps.determine.outputs.directly-changed-components-with-tests }}
@@ -167,8 +165,6 @@ jobs:
           echo "device-builder=$(echo "$output" | jq -r '.device_builder')" >> $GITHUB_OUTPUT
           echo "esp32-platformio=$(echo "$output" | jq -r '.esp32_platformio')" >> $GITHUB_OUTPUT
           echo "esp32-platformio-components=$(echo "$output" | jq -r '.esp32_platformio_components')" >> $GITHUB_OUTPUT
-          echo "esp8266-native=$(echo "$output" | jq -r '.esp8266_native')" >> $GITHUB_OUTPUT
-          echo "esp8266-native-components=$(echo "$output" | jq -r '.esp8266_native_components')" >> $GITHUB_OUTPUT
           echo "changed-components=$(echo "$output" | jq -c '.changed_components')" >> $GITHUB_OUTPUT
           echo "changed-components-with-tests=$(echo "$output" | jq -c '.changed_components_with_tests')" >> $GITHUB_OUTPUT
           echo "directly-changed-components-with-tests=$(echo "$output" | jq -c '.directly_changed_components_with_tests')" >> $GITHUB_OUTPUT
@@ -187,32 +183,6 @@ jobs:
           path: .temp/components_graph.json
           key: components-graph-${{ hashFiles('esphome/components/**/*.py') }}
 
-  seed-esp8266-native-cache:
-    name: Seed the esp8266 native toolchain cache
-    runs-on: ubuntu-24.04
-    needs:
-      - common
-    # PR-branch cache saves are invisible to other PRs, so dev pushes seed
-    # the shared entry test-esp8266-native restores. Only dev: the composite
-    # action saves nowhere else, so a beta/release push would download the
-    # toolchain and discard it.
-    if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
-    timeout-minutes: 15
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Restore Python
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-      - name: Cache the native toolchain
-        uses: ./.github/actions/cache-arduino8266
-      - name: Install the native toolchain
-        run: |
-          . venv/bin/activate
-          python -c "from esphome.arduino8266.framework import check_and_install; from esphome.components.esp8266 import RECOMMENDED_ARDUINO_FRAMEWORK_VERSION; check_and_install(RECOMMENDED_ARDUINO_FRAMEWORK_VERSION)"
-
   ci-custom:
     name: Run script/ci-custom
     runs-on: ubuntu-24.04
@@ -1258,7 +1228,7 @@ jobs:
 
           # compile validates config first, so a separate config pass is
           # redundant for this smoke test. ESP-IDF framework via PlatformIO:
-          python3 script/test_build_components.py -e compile -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain platformio --fail-on-no-tests
+          python3 script/test_build_components.py -e compile -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain platformio
 
           echo ""
           echo "ESP-IDF-via-PlatformIO build passed! Starting Arduino smoke test..."
@@ -1267,42 +1237,6 @@ jobs:
           # Arduino framework via PlatformIO (only components with an esp32-ard test are built):
           python3 script/test_build_components.py -e compile -t esp32-ard -c "$TEST_COMPONENTS" -f --toolchain platformio
 
-  test-esp8266-native:
-    name: Test esp8266 components with the native toolchain
-    runs-on: ubuntu-24.04
-    needs:
-      - common
-      - determine-jobs
-    if: github.event_name == 'pull_request' && needs.determine-jobs.outputs.esp8266-native == 'true'
-    env:
-      # Computed by script/determine-jobs.py (ESP8266_NATIVE_TEST_COMPONENTS)
-      TEST_COMPONENTS: ${{ needs.determine-jobs.outputs.esp8266-native-components }}
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Restore Python
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-
-      - name: Cache the native toolchain
-        uses: ./.github/actions/cache-arduino8266
-
-      - name: Run native toolchain compile test
-        run: |
-          . venv/bin/activate
-
-          echo "Testing components: $TEST_COMPONENTS"
-          echo ""
-
-          # ESP8266 Arduino built directly (no PlatformIO); compile validates
-          # config first, so a separate config pass is redundant. Strict pch:
-          # exercises the native ninja pch (and its probe edge) against real
-          # component configs; the docker matrix smoke-tests both toolchains.
-          ESPHOME_PCH_STRICT=1 python3 script/test_build_components.py -e compile -t esp8266-ard -c "$TEST_COMPONENTS" -f --toolchain arduino --fail-on-no-tests
-
   device-builder:
     name: Test downstream esphome/device-builder
     runs-on: ubuntu-24.04
@@ -1665,7 +1599,6 @@ jobs:
     needs:
       - common
       - seed-apt-cache
-      - seed-esp8266-native-cache
       - determine-jobs
       - ci-custom
       - pylint
@@ -1681,7 +1614,6 @@ jobs:
       - clang-tidy-esp32-variants
       - test-build-components-split
       - test-esp32-platformio
-      - test-esp8266-native
       - device-builder
       - memory-impact-target-branch
       - memory-impact-pr-branch

AGENTS.md

@@ -553,6 +553,7 @@ file does, and it is the authority when they disagree. The most useful starting
     4.  **Lint:** Run `prek` to ensure code is compliant.
     5.  **Commit:** Commit your changes. There is no strict format for commit messages.
     6.  **Pull Request:** Submit a PR against the `dev` branch. The Pull Request title must start with a `[tag]` prefix. For component work, use the component name (e.g., `[display] Fix bug`, `[abc123] Add new component`); for changes to shared/core code that isn't tied to a single component, use `[core]` (e.g., `[core] Add validator`). Update documentation, examples, and add `CODEOWNERS` entries as needed. Pull requests should always be made using the `.github/PULL_REQUEST_TEMPLATE.md` template - fill out all sections completely without removing any parts of the template.
+    7.  **Comments:** When commenting on GitHub PRs or issues, don't tag contributors, especially bots. Avoid referring to list items (e.g. from reviews) with the form #nn - this will be interpreted by GitHub as a reference to issue or PR nn. Keep comments short and exclude irrelevant details, backstories, restatement of previous comments and anything that is already obvious to the reader.
 
 *   **Documentation Contributions:**
     *   Documentation is hosted in the separate `esphome/esphome.io` repository.

THREAT_MODEL.md

@@ -125,30 +125,47 @@ design is optimal or that it will not change.
 ## OTA update encryption
 
 The `esphome` OTA platform optionally encrypts updates with the same Noise
-`NNpsk0` pattern the native API uses; one key protects the device. With an
-`encryption:` block configured the guarantees are: the firmware image is
-confidential in transit, the uploader is authenticated by the pre-shared key,
-and the plaintext negotiation preceding the handshake is bound into the
-handshake prologue, so stripping or tampering with it fails the first MAC.
-Both ends fail closed with no override: a device built with a key refuses
+`NNpsk0` pattern the native API uses; one key protects the device. A device
+whose `api:` block has an encryption key, static in the YAML or provisioned at
+runtime, compiles in the transport and offers it on every OTA connection once
+it holds a key, so an uploader presenting that key gets the guarantees below
+even without an `ota: encryption:` block; only that block makes the device
+require encryption. The guarantees are: the firmware image is confidential in
+transit, the uploader is authenticated by the pre-shared key, and the plaintext
+negotiation preceding the handshake is bound into the handshake prologue, so
+stripping or tampering with it fails the first MAC. With `ota: encryption:`
+configured both ends fail closed with no override: the device refuses
 plaintext uploads, and the CLI refuses to send plaintext when a key is
-configured.
+configured. Without that block the CLI tries a static api key when the device
+offers and, until 2027.3.0, falls back to plaintext with a warning when the
+offer is missing or the handshake fails; a runtime provisioned key never
+reaches the CLI, so those uploads stay plaintext.
 
-Defeating any of that without the key is in scope: a keyed device accepting a
-plaintext or downgraded upload, getting past the MAC, or recovering image
-contents from captured traffic.
+Defeating any of that without the key is in scope: a device that requires
+encryption accepting a plaintext or downgraded upload, getting past the MAC,
+or recovering image contents from captured traffic.
 
 The following are **not** vulnerabilities, by design:
 
-- Plaintext OTA on a device with no `encryption:` block. That is the
-  documented default, authenticated (if at all) by the OTA password.
-- The enablement window: turning encryption on takes one last upload of the
-  encryption-enabled firmware over the existing plaintext channel, with the
-  pre-existing plaintext exposure.
-- The web OTA `/update` endpoint alongside encryption. The `web_server`
-  component keeps it always reachable, and `captive_portal:` auto-loads it
-  for the fallback AP window; validation warns about both combinations, and
-  the operator keeps the recovery path.
+- Plaintext OTA on a device with no `ota: encryption:` block, including one
+  that offers encryption because it has an api key. That is the documented
+  default, authenticated (if at all) by the OTA password. An uploader that
+  takes the offer skips the password; the key authenticates it. With a
+  runtime provisioned key and no `provisioning:` window, whoever provisions
+  the key gains that upload path too; validation warns about the pair.
+- The CLI plaintext fallback until 2027.3.0: without `ota: encryption:` an
+  active attacker who strips the offer or breaks the handshake can make a
+  keyed CLI upload plaintext, with the pre-existing plaintext exposure. A
+  device that requires encryption still refuses that upload.
+- The enablement window: firmware built with a static api key already offers
+  encryption, so turning on `ota: encryption:` is itself an encrypted upload.
+  Older firmware needs one last plaintext upload of an offering build, with
+  the pre-existing plaintext exposure.
+- The web OTA `/update` endpoint alongside encryption. With the `web_server`
+  or `prometheus` component the shared listener is always up, so the endpoint
+  stays reachable and validation warns about that combination;
+  `captive_portal:` alone brings the listener up only for the fallback AP
+  window, which is the intended recovery path, so that is not warned about.
 - CLI retry behavior on transport or MAC failures; every attempt renegotiates
   a fresh handshake with fresh ephemerals, so retrying does not weaken
   authentication.

docker/Dockerfile

@@ -22,7 +22,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.14.0
+RUN uv pip install --no-cache-dir esphome-device-builder==1.14.2
 
 RUN \
     platformio settings set enable_telemetry No \

docker/test_configs/esp8266-arduino-native.yaml

@@ -1,8 +0,0 @@
-esphome:
-  name: docker-test-esp8266-native
-
-esp8266:
-  board: d1_mini
-  toolchain: arduino
-
-logger:

esphome/__main__.py

@@ -817,9 +817,7 @@ def write_cpp_file() -> int:
         from esphome.build_gen import espidf
 
         espidf.write_project()
-    elif not CORE.using_native_toolchain:
-        # Other native builds generate their project at compile time;
-        # never write a platformio.ini for them
+    else:
         from esphome.build_gen import platformio
 
         platformio.write_project()
@@ -861,14 +859,20 @@ def compile_program(args: ArgsProtocol, config: ConfigType) -> int:
         toolchain.create_factory_bin()
         toolchain.create_ota_bin()
         toolchain.create_elf_copy()
-        from esphome.build_helpers.idedata import warn_if_idedata_missing
+        from esphome.build_helpers.idedata import IDEDATA_BEST_EFFORT_ERRORS
 
-        warn_if_idedata_missing(toolchain.get_idedata)
-    elif CORE.using_native_toolchain:
-        raise EsphomeError(
-            f"Toolchain '{CORE.toolchain.value}' resolved but no platform "
-            "backend claimed the build"
-        )
+        try:
+            if toolchain.get_idedata() is None:
+                _LOGGER.warning("No idedata was generated for this build")
+        except IDEDATA_BEST_EFFORT_ERRORS as err:
+            # The firmware already built; an idedata failure must not fail
+            # a successful build.
+            _LOGGER.warning(
+                "Could not generate idedata: %s (IDE, clang-tidy, and "
+                "memory-analysis data will be unavailable for this build)",
+                err,
+            )
+            _LOGGER.debug("Idedata failure detail", exc_info=True)
     else:
         from esphome.platformio import toolchain
 
@@ -971,15 +975,12 @@ def upload_using_esptool(
 
     if file is not None:
         flash_images = [FlashImage(path=file, offset="0x0")]
-    elif (native := _native_toolchain_module()) is not None:
-        # Every native backend supplies its own 0x0 flash image (bootloader
-        # and partitions included where the target needs them)
-        image = native.get_factory_firmware_path()
-        if not image.is_file():
-            raise EsphomeError(
-                f"{image} does not exist; compile the configuration first"
-            )
-        flash_images = [FlashImage(path=image, offset="0x0")]
+    elif CORE.using_toolchain_esp_idf:
+        from esphome.espidf import toolchain
+
+        flash_images = [
+            FlashImage(path=toolchain.get_factory_firmware_path(), offset="0x0")
+        ]
     else:
         from esphome.platformio import toolchain
 
@@ -1334,12 +1335,14 @@ def _upload_via_native_api(
             break
 
     from esphome import espota2
+    from esphome.components.noise import static_encryption_key
 
     remote_port = int(ota_conf[CONF_PORT])
     password = ota_conf.get(CONF_PASSWORD)
     # Fail closed: an encryption block whose key did not resolve must never
     # fall back to a plaintext upload
     noise_psk = None
+    plaintext_fallback = False
     if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
         noise_psk = encryption_conf.get(CONF_KEY)
         if not noise_psk:
@@ -1350,6 +1353,10 @@ def _upload_via_native_api(
         # Ensure the key is a string, as required by the underlying OTA implementation.
         # It arrives here as a SensitiveStr which aioesphomeapi rejects.
         noise_psk = str(noise_psk)
+    elif api_key := static_encryption_key(config.get(CONF_API) or {}):
+        # Remove before 2027.3.0: the api key is tried, falling back to plaintext
+        noise_psk = str(api_key)
+        plaintext_fallback = True
 
     def check_partition_access(option_string: str) -> None:
         if not ota_conf.get("allow_partition_access"):
@@ -1381,7 +1388,13 @@ def _upload_via_native_api(
         _validate_bootloader_binary(binary)
 
     return espota2.run_ota(
-        network_devices, remote_port, password, binary, ota_type, noise_psk
+        network_devices,
+        remote_port,
+        password,
+        binary,
+        ota_type,
+        noise_psk,
+        plaintext_fallback=plaintext_fallback,
     )
 
 
@@ -1949,39 +1962,15 @@ def command_update_all(args: ArgsProtocol) -> int | None:
     return run_multiple_configs(files, build_command)
 
 
-# Native build backend per (target platform, toolchain). Keyed here rather
-# than through a platform hook so the serial upload/logs fast path never
-# imports the platform component package (see the esp32 variant comment in
-# upload_using_esptool); the platform half comes from CORE.data the same way.
-_NATIVE_TOOLCHAIN_MODULES = {
-    ("esp32", Toolchain.ESP_IDF): "esphome.espidf.toolchain",
-    ("esp8266", Toolchain.ARDUINO): "esphome.arduino8266.toolchain",
-}
-
-
-def _native_toolchain_module():
-    """The native build backend module for the resolved toolchain."""
-    if not CORE.using_native_toolchain:
-        return None
-    key = (CORE.target_platform, CORE.toolchain)
-    if (module_path := _NATIVE_TOOLCHAIN_MODULES.get(key)) is None:
-        # Degrading to the PlatformIO path would build with the wrong backend
-        raise EsphomeError(
-            f"Toolchain '{CORE.toolchain.value}' has no native build backend "
-            f"module for platform {CORE.target_platform}"
-        )
-    return importlib.import_module(module_path)
-
-
 def command_idedata(args: ArgsProtocol, config: ConfigType) -> int:
     import json
 
-    native_toolchain = _native_toolchain_module()
+    if CORE.using_toolchain_esp_idf:
+        # Native ESP-IDF derives idedata from the build's compile_commands.json,
+        # so the configuration must already be compiled.
+        from esphome.espidf import toolchain as espidf_toolchain
 
-    if native_toolchain is not None:
-        # Native toolchains derive idedata from the build's
-        # compile_commands.json, so the configuration must already be compiled.
-        idedata = native_toolchain.get_idedata()
+        idedata = espidf_toolchain.get_idedata()
         if idedata is None:
             _LOGGER.error(
                 "No idedata available; compile the configuration first",
@@ -2020,17 +2009,6 @@ def command_analyze_memory(args: ArgsProtocol, config: ConfigType) -> int:
     from esphome.analyze_memory.cli import MemoryAnalyzerCLI
     from esphome.analyze_memory.ram_strings import RamStringsAnalyzer
 
-    # Refuse an unsupported toolchain before paying for a full compile
-    native_toolchain = _native_toolchain_module()
-    if native_toolchain is None and not CORE.using_toolchain_platformio:
-        _LOGGER.error(
-            "analyze-memory is not supported with the '%s' toolchain on %s; "
-            "re-run with --toolchain platformio",
-            CORE.toolchain.value if CORE.toolchain else "unresolved",
-            CORE.target_platform,
-        )
-        return 1
-
     # Always compile to ensure fresh data (fast if no changes - just relinks)
     exit_code = write_cpp(config)
     if exit_code != 0:
@@ -2042,31 +2020,13 @@ def command_analyze_memory(args: ArgsProtocol, config: ConfigType) -> int:
 
     # Get idedata for analysis
     idedata = None
-    if native_toolchain is not None:
-        objdump = native_toolchain.get_objdump_path()
-        readelf = native_toolchain.get_readelf_path()
-        for tool in (objdump, readelf):
-            if not tool.is_file():
-                # The analyzer would silently fall back to host binutils,
-                # which cannot read the target ELF. clean-all is heavy for
-                # ESP-IDF, so suggest a recompile first.
-                _LOGGER.error(
-                    "%s is missing; the toolchain install may be incomplete "
-                    "(recompile, or run 'esphome clean-all' if it persists)",
-                    tool,
-                )
-                return 1
-        objdump_path = str(objdump)
-        readelf_path = str(readelf)
+    if CORE.using_toolchain_esp_idf:
+        from esphome.espidf import toolchain
 
-        firmware_elf = native_toolchain.get_elf_path()
-        if not firmware_elf.is_file():
-            # The analyzer swallows tool failures, so a missing ELF would
-            # produce an exit-0 zeroed report
-            _LOGGER.error(
-                "%s is missing; compile the configuration first", firmware_elf
-            )
-            return 1
+        objdump_path = str(toolchain.get_objdump_path())
+        readelf_path = str(toolchain.get_readelf_path())
+
+        firmware_elf = toolchain.get_elf_path()
     else:
         from esphome.platformio import toolchain
 

esphome/arduino8266/framework.py

@@ -19,7 +19,6 @@ from typing import NamedTuple
 
 from esphome.build_helpers.ccache import ccache_defaults_env
 from esphome.build_helpers.ninja import find_ninja
-from esphome.build_helpers.pch import ccache_pch_env
 from esphome.build_helpers.tools_cache import ARDUINO8266_TOOLS_CACHE, tools_cache_path
 from esphome.core import EsphomeError, Version
 from esphome.framework_helpers import str_to_lst_of_str
@@ -157,6 +156,4 @@ def ccache_env(ccache: str | None) -> dict[str, str]:
     """
     if ccache is None:
         return {}
-    env = ccache_defaults_env(get_arduino8266_tools_path() / "ccache")
-    env.update(ccache_pch_env())
-    return env
+    return ccache_defaults_env(get_arduino8266_tools_path() / "ccache")

esphome/arduino8266/toolchain.py

@@ -1,329 +0,0 @@
-"""Native Arduino ESP8266 build driver (the PlatformIO ``run`` equivalent)."""
-
-from __future__ import annotations
-
-import json
-import logging
-from pathlib import Path
-import subprocess
-from typing import Any
-
-from esphome.arduino8266 import framework
-from esphome.build_helpers.ccache import resolve_ccache_path
-from esphome.const import (
-    CONF_COMPILE_PROCESS_LIMIT,
-    CONF_ESPHOME,
-    KEY_CORE,
-    KEY_FRAMEWORK_VERSION,
-)
-from esphome.core import CORE, EsphomeError
-from esphome.helpers import write_file_if_changed
-from esphome.types import ConfigType
-
-_LOGGER = logging.getLogger(__name__)
-
-# ESP8266 user RAM (matches upload.maximum_ram_size in every board manifest)
-_MAX_RAM_SIZE = 81920
-
-
-def _warn_ignored_platformio_options() -> None:
-    """Warn for component-added platformio options the native build drops.
-
-    The consumed set is exported by core/config.py next to the routing that
-    stores these options, so the two cannot drift; YAML upload_speed never
-    reaches CORE.platformio_options here.
-    """
-    from esphome.core.config import NATIVE_ARDUINO_CONSUMED_PIO_OPTIONS
-
-    consumed = NATIVE_ARDUINO_CONSUMED_PIO_OPTIONS
-    for key in sorted(CORE.platformio_options or {}):
-        if key not in consumed:
-            _LOGGER.warning(
-                "platformio_options->%s is ignored when building with the "
-                "native 'arduino' toolchain",
-                key,
-            )
-
-
-_RAM_SECTIONS = (".data", ".rodata", ".bss")
-_FLASH_SECTIONS = (".irom0.text", ".text", ".text1", ".data", ".rodata")
-
-
-def get_build_dir() -> Path:
-    return CORE.relative_pioenvs_path(CORE.name)
-
-
-def get_elf_path() -> Path:
-    return get_build_dir() / "firmware.elf"
-
-
-def _toolchain_tool(name: str) -> Path:
-    return framework.toolchain_tool(framework.get_toolchain_path(), name)
-
-
-def get_factory_firmware_path() -> Path:
-    """The image to serial-flash at 0x0 (same bytes as firmware.bin: the
-    8266 factory copy exists for artifact-contract parity, not content)."""
-    return get_build_dir() / "firmware.factory.bin"
-
-
-def get_addr2line_path() -> Path:
-    return _toolchain_tool("addr2line")
-
-
-def get_objdump_path() -> Path:
-    return _toolchain_tool("objdump")
-
-
-def get_readelf_path() -> Path:
-    return _toolchain_tool("readelf")
-
-
-def run_compile(config: ConfigType, verbose: bool) -> int:
-    from esphome.build_gen import arduino8266 as build_gen
-
-    _warn_ignored_platformio_options()
-    paths = framework.check_and_install(CORE.data[KEY_CORE][KEY_FRAMEWORK_VERSION])
-    # Resolved once per build: the resolution probes PATH and spawns the
-    # runnability check, and three consumers need the same answer
-    ccache = resolve_ccache_path()
-    ninja_changed = build_gen.write_project(paths, ccache)
-
-    build_dir = get_build_dir()
-    env = framework.get_build_env(paths.toolchain, ccache)
-
-    # Regenerate the compile DB before the build (a pure function of
-    # build.ninja); skip only when it is at least as fresh as build.ninja
-    # (an interrupted previous run may have rewritten the manifest without
-    # regenerating the DB).
-    compdb = build_dir / "compile_commands.json"
-    compdb_stamp = build_dir / ".compile_commands.stamp"
-    ninja_file = build_dir / "build.ninja"
-    # Freshness rides a stamp: the DB itself is written through
-    # write_file_if_changed (its mtime feeds get_idedata's cache), so a
-    # regeneration with identical content would stay "stale" forever
-    if (
-        ninja_changed
-        or not compdb.is_file()
-        or not compdb_stamp.is_file()
-        or compdb_stamp.stat().st_mtime < ninja_file.stat().st_mtime
-    ):
-        _write_compile_commands(paths.ninja, build_dir, env)
-        compdb_stamp.touch()
-
-    cmd = [str(paths.ninja)]
-    if verbose:
-        cmd.append("-v")
-    if jobs := config[CONF_ESPHOME].get(CONF_COMPILE_PROCESS_LIMIT):
-        cmd += ["-j", str(jobs)]
-    # Explicit targets, not the default statement: a generator defect that
-    # drops them fails loudly with "unknown target" instead of a green
-    # no-op run that leaves stale artifacts in place
-    targets = ["firmware.factory.bin", "firmware.ota.bin"]
-    cmd += targets
-
-    # A dry-run probe keeps a no-op rebuild quiet: ninja would only print
-    # "no work to do". A freshly rewritten manifest all but guarantees work,
-    # so skip the probe (and its full stat pass) on that path. cwd instead
-    # of -C also drops the "Entering directory" banner on real builds.
-    skip_build = False
-    if not ninja_changed:
-        probe = subprocess.run(
-            [str(paths.ninja), "-n", *targets],
-            cwd=build_dir,
-            env=env,
-            capture_output=True,
-            text=True,
-            check=False,
-            close_fds=False,
-        )
-        if probe.stderr.strip():
-            # A load-time diagnostic (e.g. "multiple rules generate X")
-            # flags a generator bug; the skip branch would otherwise
-            # swallow it forever
-            _LOGGER.warning("ninja: %s", probe.stderr.strip())
-        if probe.returncode != 0:
-            # An unknown target here is the defective-manifest case; fall
-            # through to the real build so the error prints attributably
-            _LOGGER.debug("ninja probe failed; running the full build")
-        skip_build = probe.returncode == 0 and "no work to do" in probe.stdout
-    if skip_build:
-        _LOGGER.debug("ninja: nothing to rebuild")
-    else:
-        _LOGGER.debug("Running: %s", " ".join(cmd))
-        rc = subprocess.run(
-            cmd, cwd=build_dir, env=env, check=False, close_fds=False
-        ).returncode
-        if rc != 0:
-            return rc
-
-    # ninja already refused a manifest missing the explicit targets above;
-    # existence covers the remaining hole (a rule that ran but wrote
-    # elsewhere). The factory/ota copies are what upload and OTA consume.
-    build_dir_artifacts = (
-        get_elf_path(),
-        build_dir / "firmware.bin",
-        get_factory_firmware_path(),
-        build_dir / "firmware.ota.bin",
-    )
-    for artifact in build_dir_artifacts:
-        if not artifact.is_file():
-            _LOGGER.error("Build produced no %s", artifact)
-            return 1
-
-    if not _print_size_summary(build_dir, paths):
-        # The cause was already warned; name the consequence so a build
-        # contributing no RAM/Flash metric is visible to CI harnesses
-        _LOGGER.warning("Firmware size summary unavailable for this build")
-    from esphome.build_helpers.idedata import warn_if_idedata_missing
-
-    warn_if_idedata_missing(lambda: get_idedata(ccache))
-    return 0
-
-
-def _write_compile_commands(
-    ninja_path: Path, build_dir: Path, env: dict[str, str]
-) -> None:
-    compdb = build_dir / "compile_commands.json"
-    result = subprocess.run(
-        [str(ninja_path), "-C", str(build_dir), "-t", "compdb", "c", "cxx", "asm"],
-        env=env,
-        capture_output=True,
-        text=True,
-        check=False,
-        close_fds=False,
-    )
-    if result.returncode != 0:
-        # Drop any stale database so consumers (IDE integration, clang-tidy,
-        # the memory analyzer) can't silently read outdated data.
-        compdb.unlink(missing_ok=True)
-        raise EsphomeError(f"Could not generate compile_commands.json: {result.stderr}")
-    try:
-        entries = json.loads(result.stdout)
-    except ValueError as err:
-        compdb.unlink(missing_ok=True)
-        raise EsphomeError(
-            f"ninja produced an unparsable compile database: {err} "
-            f"(output starts {result.stdout[:120]!r})"
-        ) from err
-    if not entries:
-        # compdb exits 0 with [] for unknown rule names; a renamed compile
-        # rule must fail the build, not silently strand every consumer
-        compdb.unlink(missing_ok=True)
-        raise EsphomeError(
-            "ninja produced an empty compile database; the generator's rule "
-            "names no longer match"
-        )
-    # write_file_if_changed keeps the mtime stable on no-op builds so the
-    # idedata cache in get_idedata() stays valid.
-    write_file_if_changed(compdb, result.stdout)
-
-
-def _parse_app_size(build_dir: Path, paths: framework.InstalledPaths) -> int | None:
-    """Read the app flash budget (irom0_0_seg length) from the linker script."""
-    from esphome.build_gen.arduino8266 import get_flash_ld_path
-    from esphome.components.esp8266.build_surgery import segment_length
-
-    # Warnings, not debug: without the app size the Flash summary line is
-    # dropped and CI's memory-impact extraction loses its flash metric.
-    ld_path = get_flash_ld_path(build_dir, paths)
-    try:
-        ld_text = ld_path.read_text(encoding="utf-8")
-    except (OSError, UnicodeDecodeError) as err:
-        # UnicodeDecodeError: a truncated/corrupt script must degrade to
-        # the same warning, never abort an already-linked build
-        _LOGGER.warning("Cannot read linker script for the Flash summary: %s", err)
-        return None
-    app_size = segment_length(ld_text, "irom0_0_seg")
-    if app_size is None:
-        _LOGGER.warning("irom0_0_seg not found in %s; skipping Flash summary", ld_path)
-        return None
-    if app_size == 0:
-        _LOGGER.warning(
-            "irom0_0_seg has zero length in %s; skipping Flash summary", ld_path
-        )
-        return None
-    return app_size
-
-
-def _print_size_summary(build_dir: Path, paths: framework.InstalledPaths) -> bool:
-    """Print the PlatformIO-shaped RAM/Flash lines; False when skipped.
-
-    The exact shape (including the bar) is parsed by
-    ``script/ci_memory_impact_extract.py``; ``print_size_line`` matches it.
-    """
-    from esphome.build_helpers.size_summary import print_size_line
-
-    size_tool = _toolchain_tool("size")
-    try:
-        result = subprocess.run(
-            [str(size_tool), "-A", "-d", str(get_elf_path())],
-            capture_output=True,
-            text=True,
-            check=False,
-            close_fds=False,
-        )
-    except OSError as err:
-        # The summary is a bonus artifact like idedata; a truncated
-        # toolchain extraction must not discard an already-linked build
-        _LOGGER.warning("Could not summarize firmware size: %s", err)
-        return False
-    if result.returncode != 0:
-        _LOGGER.warning("Could not summarize firmware size: %s", result.stderr)
-        return False
-    sections: dict[str, int] = {}
-    for line in result.stdout.splitlines():
-        parts = line.split()
-        if len(parts) >= 2 and parts[0].startswith("."):
-            try:
-                sections[parts[0]] = int(parts[1])
-            except ValueError:
-                # An unparsed RAM/Flash section trips the missing-sections
-                # guard below, so no total is built on a dropped value
-                _LOGGER.warning("Unparsable size output for section %s", parts[0])
-    if missing := set(_RAM_SECTIONS + _FLASH_SECTIONS) - set(sections):
-        # A defaulted 0 would print a confidently wrong total for CI's metric
-        _LOGGER.warning(
-            "Size output is missing section(s) %s; skipping the size summary",
-            ", ".join(sorted(missing)),
-        )
-        return False
-    # Resolve the flash budget before printing anything: a RAM line without
-    # its Flash line would let CI's memory-impact extraction sum the two
-    # metrics over different build counts (_parse_app_size already warned).
-    app_size = _parse_app_size(build_dir, paths)
-    if not app_size:
-        return False
-    ram = sum(sections[s] for s in _RAM_SECTIONS)
-    flash = sum(sections[s] for s in _FLASH_SECTIONS)
-    print_size_line("RAM", ram, _MAX_RAM_SIZE)
-    print_size_line("Flash", flash, app_size)
-    return True
-
-
-# Sentinel: "resolve for me"; None is a real value meaning disabled.
-_CCACHE_UNRESOLVED: Any = object()
-
-
-def get_idedata(ccache: str | None = _CCACHE_UNRESOLVED) -> dict | None:
-    """Derive idedata from the build's compile_commands.json.
-
-    Same contract as ``espidf.toolchain.get_idedata``: the fields IDE
-    integrations, clang-tidy, and the memory analyzer expect.
-    """
-    from esphome.build_helpers.idedata import load_or_build_idedata
-
-    if ccache is _CCACHE_UNRESOLVED:
-        # Deliberately uncached: env/PATH can change between builds in a
-        # long-lived host process
-        ccache = resolve_ccache_path()
-    return load_or_build_idedata(
-        get_build_dir() / "compile_commands.json",
-        get_elf_path(),
-        # Suffixed so a platformio->arduino->platformio round trip on one
-        # config never serves the other toolchain's cache shape
-        CORE.relative_internal_path("idedata", f"{CORE.name}.arduino.json"),
-        # The compile DB's commands carry the same ccache prefix the ninja
-        # rules were generated with
-        launcher=str(ccache) if ccache else None,
-    )

esphome/build_gen/build_tool.py

@@ -6,7 +6,6 @@ started esphome and must not depend on the package being importable.
 Subcommands:
     ar <ar-binary> <archive> <rspfile>   remove stale archive, then ``ar rcs``
     copy <src> <dst>                     copy a file
-    touch <path>                         create/update a stamp file
 
 The ar rspfile carries one object path per line (the generating rule must
 use ``$in_newline``, never ``$in``).
@@ -84,18 +83,9 @@ def _run_copy(src: str, dst: str) -> int:
     return 0
 
 
-def _run_touch(path: str) -> int:
-    try:
-        Path(path).touch()
-    except OSError as err:
-        print(f"touch: {path} failed: {err}", file=sys.stderr)
-        return 1
-    return 0
-
-
 # mode -> (handler, expected operand count); surplus argv means a
 # mis-specified ninja rule and must error, not silently drop operands
-_MODES = {"ar": (_run_ar, 3), "copy": (_run_copy, 2), "touch": (_run_touch, 1)}
+_MODES = {"ar": (_run_ar, 3), "copy": (_run_copy, 2)}
 
 
 def main() -> int:

esphome/build_gen/espidf.py

@@ -4,14 +4,6 @@ import json
 import logging
 from pathlib import Path
 
-from esphome.build_helpers import pch
-from esphome.build_helpers.pch import (
-    PCH_DEFAULT_HEADERS,
-    PCH_HEADER_NAME,
-    mark_pch_emitted,
-    pch_enabled,
-    pch_header_text,
-)
 from esphome.components.esp32 import (
     get_esp32_variant,
     get_excluded_builtin_components,
@@ -287,74 +279,9 @@ idf_component_register(
 target_link_options(${{COMPONENT_LIB}} PUBLIC
     {link_opts_str}
 )
-{_pch_cmake()}"""
-
-
-def _pch_cmake() -> str:
-    """The src component's precompiled-header block (C++ TUs only).
-
-    The -include stays relative (resolved from the compiler cwd, the build
-    dir); an absolute path would poison ccache keys.
-    """
-    if not pch_enabled():
-        return ""
-    # Strict inverts: a per-process consumer rejection reds the build.
-    # Baked at generation: a knob flip takes effect when the CMakeLists is
-    # rewritten (every esphome compile); a hand-run idf.py keeps the old one
-    escalation = pch.pch_consumer_escalation()
-    return f"""
-# ESPHome precompiled header (see esphome/build_helpers/pch.py).
-# OBJECT_DEPENDS is on the header, not the .gch: pch-baked headers drop
-# out of TU depfiles, and prepare_pch() touches the header on rebuild.
-target_compile_options(${{COMPONENT_LIB}} PRIVATE
-    "$<$<COMPILE_LANGUAGE:CXX>:-Winvalid-pch>"
-    "$<$<COMPILE_LANGUAGE:CXX>:{escalation}>"
-    "$<$<COMPILE_LANGUAGE:CXX>:-include>"
-    "$<$<COMPILE_LANGUAGE:CXX>:{PCH_HEADER_NAME}>"
-)
-set_source_files_properties(${{app_sources}} PROPERTIES
-    OBJECT_DEPENDS "${{CMAKE_BINARY_DIR}}/{PCH_HEADER_NAME}")
 """
 
 
-def discard_pch() -> None:
-    """Drop the pch sidecars in the IDF build dir."""
-    pch.discard_pch(CORE.relative_build_path("build"))
-
-
-def prepare_pch() -> None:
-    """Build the .gch right before ninja, after every reconfigure, so the
-    compile_commands.json flags and the sdkconfig are the settled ones."""
-    if not pch_enabled():
-        # Self-cleaning escape hatch: drop any previously built .gch
-        pch.discard_pch(CORE.relative_build_path("build"))
-        pch.pch_disabled_degraded()
-        return
-    sdkconfig_path = CORE.relative_build_path(f"sdkconfig.{CORE.name}")
-    try:
-        sdkconfig = sdkconfig_path.read_text(encoding="utf-8")
-    except OSError as err:
-        # Fail closed: the sdkconfig is the .sum's only config identity for
-        # sdkconfig.h-only options; a stand-in marker would collide
-        _LOGGER.warning(
-            "Could not read %s; compiling without the pch: %s", sdkconfig_path, err
-        )
-        pch.discard_pch(CORE.relative_build_path("build"))
-        pch.pch_degraded(f"sdkconfig unreadable: {err}")
-        return
-    pch.prepare_pch(
-        CORE.relative_build_path("build"),
-        PCH_DEFAULT_HEADERS,
-        (
-            str(idf_version()),
-            CORE.cpp_standard or "",
-            sdkconfig,
-            *get_project_compile_flags(),
-            *get_project_cxx_compile_flags(),
-        ),
-    )
-
-
 def write_project(
     minimal: bool = False, builtin_components: list[str] | None = None
 ) -> None:
@@ -374,14 +301,6 @@ def write_project(
         get_component_cmakelists(),
     )
 
-    if pch_enabled():
-        write_file_if_changed(
-            CORE.relative_build_path("build", PCH_HEADER_NAME),
-            pch_header_text(PCH_DEFAULT_HEADERS),
-        )
-        # Consumers carry the -include; gate the ccache relaxation on it
-        mark_pch_emitted()
-
     # Snapshot the exclusion set so has_outdated_files() can trigger a
     # discovery reconfigure when it changes. Excluded components never
     # register in project_description.json, so re-including one (e.g. a

esphome/build_helpers/ccache.py

@@ -21,13 +21,12 @@ def _ccache_runs(ccache: str) -> bool:
     )
 
 
-def parse_enable_env(name: str, strict: bool = False) -> bool | None:
+def parse_enable_env(name: str) -> bool | None:
     """Strictly parse an on/off environment knob; None when unset or invalid.
 
     ``bool(str)`` truthiness would flip ``no``/``off`` to enabled, so only
     1/true/yes/on and 0/false/no/off count; anything else warns and reads
-    as unset so the caller's default policy applies — or raises when
-    ``strict`` (a typo must not silently disable a CI gate).
+    as unset so the caller's default policy applies.
     """
     raw = os.environ.get(name)
     if raw is None:
@@ -40,10 +39,6 @@ def parse_enable_env(name: str, strict: bool = False) -> bool | None:
         return True
     if lowered in FALSY_ENV_STRINGS:
         return False
-    if strict:
-        from esphome.core import EsphomeError
-
-        raise EsphomeError(f"Unrecognized {name}={raw!r}; use 1 or 0")
     _LOGGER.warning("Ignoring unrecognized %s=%r; use 1 or 0", name, raw)
     return None
 
@@ -92,19 +87,6 @@ def ccache_defaults_env(cache_dir: Path) -> dict[str, str]:
         "CCACHE_DIR": str(cache_dir),
         "CCACHE_NOHASHDIR": "true",
         "CCACHE_DEPEND": "1",
-        # A user value wins via the filter below
-        "CCACHE_BASEDIR": effective_ccache_basedir(),
+        "CCACHE_BASEDIR": str(Path(CORE.build_path).resolve()),
     }
     return {k: v for k, v in defaults.items() if k not in os.environ}
-
-
-def effective_ccache_basedir() -> str:
-    """The prefix ccache rewrites out of hashed paths: a user CCACHE_BASEDIR
-    wins, else the resolved build path (matching ccache_defaults_env)."""
-    from esphome.core import CORE
-
-    raw = os.environ.get("CCACHE_BASEDIR")
-    if raw is not None and Path(raw).is_absolute() and len(Path(raw).parts) > 1:
-        return raw
-    # Unset or degenerate ("", "/", relative): fall back to the build path
-    return str(Path(CORE.build_path).resolve())

esphome/build_helpers/idedata.py

@@ -11,7 +11,6 @@ consumers (IDE integration, clang-tidy) expect:
 
 from __future__ import annotations
 
-from collections.abc import Callable
 import json
 import logging
 import os
@@ -22,8 +21,6 @@ import subprocess
 from esphome.core import EsphomeError
 from esphome.helpers import write_file
 
-_LOGGER = logging.getLogger(__name__)
-
 # Everything idedata generation may raise after a successful link; idedata
 # is a bonus artifact, so consumers warn instead of failing the build
 IDEDATA_BEST_EFFORT_ERRORS = (
@@ -34,36 +31,13 @@ IDEDATA_BEST_EFFORT_ERRORS = (
     ValueError,
 )
 
+_LOGGER = logging.getLogger(__name__)
 
-def warn_if_idedata_missing(get_idedata: Callable[[], dict | None]) -> None:
-    """Run an idedata generator, downgrading any failure to a warning.
-
-    Shared by the native backends: the firmware already built, so a missing
-    or broken idedata must not fail a successful build.
-    """
-    try:
-        if get_idedata() is None:
-            _LOGGER.warning("No idedata was generated for this build")
-    except IDEDATA_BEST_EFFORT_ERRORS as err:
-        _LOGGER.warning(
-            "Could not generate idedata: %s (IDE, clang-tidy, and "
-            "memory-analysis data will be unavailable for this build)",
-            err,
-        )
-        if isinstance(err, (EsphomeError, OSError)):
-            # Routine environmental failures keep the detail at debug
-            _LOGGER.debug("Idedata failure detail", exc_info=True)
-        else:
-            # LookupError/ValueError/RuntimeError smell like a parsing bug;
-            # a permanently masked traceback would hide it on every build
-            _LOGGER.warning("Idedata failure detail", exc_info=True)
-
-
-# C++ translation-unit suffixes.
-CXX_SOURCE_SUFFIXES = (".cpp", ".cc", ".cxx")
+# C++ translation-unit suffixes used to identify ESPHome source files.
+_CXX_SUFFIXES = (".cpp", ".cc")
 # Suffixes of input/output files that appear bare on the command line (and so
 # must not be mistaken for compiler flags).
-_INPUT_FILE_SUFFIXES = (*CXX_SOURCE_SUFFIXES, ".c", ".o", ".S", ".s")
+_INPUT_FILE_SUFFIXES = (*_CXX_SUFFIXES, ".c", ".o", ".S", ".s")
 # Path marker identifying an ESPHome source translation unit.
 _ESPHOME_SRC_MARKER = "/src/esphome/"
 
@@ -72,11 +46,11 @@ def _is_esphome_src(file: str) -> bool:
     """Whether ``file`` is an ESPHome C++ translation unit; normalized to
     ``/`` first since Windows compile DBs use backslashes."""
     return _ESPHOME_SRC_MARKER in file.replace("\\", "/") and file.endswith(
-        CXX_SOURCE_SUFFIXES
+        _CXX_SUFFIXES
     )
 
 
-def split_command(command: str) -> list[str]:
+def _split_command(command: str) -> list[str]:
     r"""Tokenize a compile_commands.json / response-file command string.
 
     On Windows, tokenize per Windows ``argv`` rules via ``CommandLineToArgvW``.
@@ -112,7 +86,7 @@ def split_command(command: str) -> list[str]:
         ctypes.windll.kernel32.LocalFree(argv)
 
 
-def expand_response_files(tokens: list[str], directory: Path) -> list[str]:
+def _expand_response_files(tokens: list[str], directory: Path) -> list[str]:
     """Inline any ``@response-file`` arguments (paths relative to ``directory``).
 
     GCC response files embed flags that must be expanded so GCC-only flags
@@ -127,8 +101,8 @@ def expand_response_files(tokens: list[str], directory: Path) -> list[str]:
                 rf = directory / rf
             try:
                 out.extend(
-                    expand_response_files(
-                        split_command(rf.read_text(encoding="utf-8")), directory
+                    _expand_response_files(
+                        _split_command(rf.read_text(encoding="utf-8")), directory
                     )
                 )
                 continue
@@ -147,7 +121,7 @@ def _pick_entry(entries: list[dict]) -> dict:
         if _is_esphome_src(entry["file"]):
             return entry
     for entry in entries:
-        if entry["file"].endswith(CXX_SOURCE_SUFFIXES):
+        if entry["file"].endswith(_CXX_SUFFIXES):
             return entry
     raise ValueError("no C++ translation unit found in compile_commands.json")
 
@@ -157,25 +131,16 @@ def _pick_entry(entries: list[dict]) -> dict:
 _LAUNCHER_STEMS = frozenset({"ccache", "sccache", "distcc", "icecc", "buildcache"})
 
 
-def is_launcher(token: str) -> bool:
+def _is_launcher(token: str) -> bool:
     return Path(token).stem.lower() in _LAUNCHER_STEMS
 
 
-def is_joined_include(tok: str) -> bool:
-    """The joined ``-includefoo.h`` spelling; excludes clang's -include-pch."""
-    return (
-        tok.startswith("-include")
-        and tok != "-include"
-        and not tok.startswith("-include-")
-    )
-
-
 def parse_entry(
     entry: dict, launcher: str | None = None
 ) -> tuple[str, list[str], list[str], list[str]]:
     """Parse one compile_commands entry -> (cxx_path, defines, includes, cxx_flags)."""
     directory = Path(entry["directory"])
-    tokens = expand_response_files(split_command(entry["command"]), directory)
+    tokens = _expand_response_files(_split_command(entry["command"]), directory)
 
     def _include(raw: str) -> str:
         # Resolve against the entry's ``directory`` so cached idedata works
@@ -191,7 +156,7 @@ def parse_entry(
     if not tokens:
         # An empty command, or one that was only the launcher; fail by name
         raise ValueError(f"empty compile command for {entry.get('file')}")
-    if is_launcher(tokens[0]) and len(tokens) > 1 and not tokens[1].startswith("-"):
+    if _is_launcher(tokens[0]) and len(tokens) > 1 and not tokens[1].startswith("-"):
         # Stale DB built with a launcher this run no longer configures; the
         # real compiler is the next token
         _LOGGER.warning("Stripping unconfigured launcher %s", tokens[0])
@@ -204,23 +169,11 @@ def parse_entry(
     defines: list[str] = []
     includes: list[str] = []
     cxx_flags: list[str] = []
-    unresolved_force_includes: list[str] = []
 
     it = iter(tokens[1:])
     for tok in it:
         if tok in ("-c", "-o"):
             next(it, None)  # drop the flag and its argument (input/output)
-        elif tok == "-include" or is_joined_include(tok):
-            # Re-anchor only names next to the compile (the pch); a name
-            # meant for the -I chain must stay untouched
-            raw = next(it, "") if tok == "-include" else tok[len("-include") :]
-            if not raw:
-                _LOGGER.warning("Dropping -include with no argument")
-            elif Path(resolved := _include(raw)).is_file():
-                cxx_flags.extend(("-include", resolved))
-            else:
-                unresolved_force_includes.append(raw)
-                cxx_flags.extend(("-include", raw))
         elif tok.startswith("-D"):
             # ``.strip()`` handles tokens like ``-D CONFIGURED=1`` (a single
             # quoted arg with a space after -D) that some flags arrive as.
@@ -239,14 +192,6 @@ def parse_entry(
             pass  # input/output files
         else:
             cxx_flags.append(tok)
-    for raw in unresolved_force_includes:
-        # A deleted build artifact would otherwise surface only downstream
-        if not any((Path(inc) / raw).is_file() for inc in includes):
-            _LOGGER.warning(
-                "-include %s found neither next to the compile nor on the "
-                "include path; cached idedata may not resolve it",
-                raw,
-            )
     return cxx_path, defines, includes, cxx_flags
 
 
@@ -311,7 +256,7 @@ def _cache_usable(cached: object) -> bool:
     if not isinstance(cached, dict) or "cc_path" not in cached:
         return False
     cxx_path = cached.get("cxx_path")
-    if not isinstance(cxx_path, str) or is_launcher(cxx_path):
+    if not isinstance(cxx_path, str) or _is_launcher(cxx_path):
         return False
     includes = cached.get("includes")
     return isinstance(includes, dict) and isinstance(includes.get("build"), list)
@@ -359,7 +304,7 @@ def load_or_build_idedata(
 def reject_launcher_compiler(cxx_path: str) -> None:
     """Reject a compile DB naming a launcher (ccache) as the compiler; it
     must never be probed, cached, or consumed."""
-    if is_launcher(cxx_path):
+    if _is_launcher(cxx_path):
         raise EsphomeError(
             f"compile_commands.json names the launcher {cxx_path} as the "
             "compiler; the compile database is unusable"

esphome/build_helpers/pch.py

@@ -1,549 +0,0 @@
-"""Shared precompiled-header policy for the build backends.
-
-The prefix either mirrors the TUs' own force-includes (ESP8266) or is a
-curated core-header set (ESP-IDF). ``esphome: includes:`` sources receive
-it too; Arduino.h visibility there is intended (esphome#8693).
-"""
-
-from __future__ import annotations
-
-from collections.abc import Iterable
-from contextlib import suppress
-from dataclasses import dataclass
-import hashlib
-import json
-import logging
-import os
-from pathlib import Path
-import posixpath
-import re
-import stat
-import subprocess
-
-from esphome.build_helpers.ccache import effective_ccache_basedir, parse_enable_env
-from esphome.build_helpers.idedata import (
-    CXX_SOURCE_SUFFIXES,
-    expand_response_files,
-    is_launcher,
-    split_command,
-)
-
-_DOMAIN = "pch"
-
-
-@dataclass
-class _PCHData:
-    emitted: bool = False
-
-
-def _pch_data() -> _PCHData:
-    from esphome.core import CORE
-
-    if _DOMAIN not in CORE.data:
-        CORE.data[_DOMAIN] = _PCHData()
-    return CORE.data[_DOMAIN]
-
-
-def mark_pch_emitted() -> None:
-    """Record that this build's consumers reference the pch."""
-    _pch_data().emitted = True
-
-
-_LOGGER = logging.getLogger(__name__)
-
-# The header and its .gch/.sum sidecars live in the build directory.
-PCH_HEADER_NAME = "esphome_pch.h"
-
-# Every artifact the pch machinery can leave behind, for cleanup.
-PCH_ARTIFACT_NAMES = (
-    PCH_HEADER_NAME,
-    f"{PCH_HEADER_NAME}.gch",
-    f"{PCH_HEADER_NAME}.gch.sum",
-    f"{PCH_HEADER_NAME}.gch.failed",
-)
-
-# The core defines header every backend anchors its prefix on.
-PCH_CORE_HEADER = "esphome/core/defines.h"
-
-# Prefix-header contents for backends that inject a curated set (rather
-# than mirroring the TUs' own force-includes), defines.h first so USE_*
-# macros exist for the rest. Deliberately hard-coded: frequency-derived
-# sets measured no better and kept selecting headers that cannot compile
-# standalone (X-macro, platform-variant). Every entry must be safe to
-# include first in an empty TU. Caveat: application.h/automation.h become
-# ambiently visible, so a TU missing those #includes still builds on such
-# backends; ESPHOME_PCH_ENABLE=0 restores the strict view.
-PCH_DEFAULT_HEADERS = (
-    PCH_CORE_HEADER,
-    "esphome/core/component.h",
-    "esphome/core/helpers.h",
-    "esphome/core/log.h",
-    "esphome/core/application.h",
-    "esphome/core/automation.h",
-)
-
-# ccache cannot hash through a .gch; CCACHE_PCH_EXTSUM makes it hash the
-# .sum sidecar instead of the .gch bytes, which are not reproducible.
-# Keep in sync with the literals in platformio/pch.py.script.
-_CCACHE_PCH_ENV = {
-    "CCACHE_SLOPPINESS": "pch_defines,time_macros",
-    "CCACHE_PCH_EXTSUM": "true",
-}
-
-# Both include forms: an angle include resolving under src/ must enter the
-# digest too; ones that do not resolve simply end the walk
-# Compiler failures that clear on their own must not latch the .failed marker
-_TRANSIENT_ERRORS = ("No space left", "Cannot allocate", "Resource temporarily")
-
-_INCLUDE_RE = re.compile(rb'^\s*#\s*include\s+["<]([^">]+)[">]', re.MULTILINE)
-
-
-def pch_enabled() -> bool:
-    """Precompiled-header knob: default on, ``ESPHOME_PCH_ENABLE=0`` opts out."""
-    return parse_enable_env("ESPHOME_PCH_ENABLE") is not False
-
-
-def pch_strict() -> bool:
-    """CI knob: ``ESPHOME_PCH_STRICT=1`` turns pch degrade paths fatal.
-
-    A set-but-unrecognized value raises: a typo must not silently turn
-    the gate into a no-op that proves nothing.
-    """
-    return parse_enable_env("ESPHOME_PCH_STRICT", strict=True) is True
-
-
-def pch_degraded(reason: str) -> None:
-    """Every degrade path funnels through here; strict mode raises."""
-    if pch_strict():
-        from esphome.core import EsphomeError
-
-        raise EsphomeError(f"ESPHOME_PCH_STRICT: {reason}")
-
-
-def pch_disabled_degraded() -> None:
-    """Strict CI must not read "no pch at all" as success."""
-    pch_degraded("pch disabled by ESPHOME_PCH_ENABLE")
-
-
-def pch_probe_tail(source: str = "-") -> list[str]:
-    """The syntax-only compile shared by the probe and its baseline."""
-    return ["-fsyntax-only", "-x", "c++", source]
-
-
-def pch_probe_args(header: str, source: str = "-") -> list[str]:
-    """Flags that load-check a built .gch via a syntax-only compile.
-
-    Rejection must be a nonzero exit (never just a wording match), so the
-    invalid-pch class is always escalated. ``source`` defaults to stdin
-    (host independent); the ninja probe edge passes a real file.
-    """
-    return [
-        "-Winvalid-pch",
-        "-Werror=invalid-pch",
-        "-include",
-        header,
-        *pch_probe_tail(source),
-    ]
-
-
-def pch_consumer_escalation() -> str:
-    """Consumer-side invalid-pch flag: strict reds the build on rejection
-    (per-process, so the probe alone cannot prove the consumers)."""
-    return "-Werror=invalid-pch" if pch_strict() else "-Wno-error=invalid-pch"
-
-
-def ccache_pch_env() -> dict[str, str]:
-    """Settings ccache needs to cache compiles that consume the .gch;
-    empty unless this build actually emitted one. User-set values win.
-    Native backends export these process-wide; only time_macros affects
-    non-pch TUs."""
-    if not (pch_enabled() and _pch_data().emitted):
-        return {}
-    extsum = os.environ.get("CCACHE_PCH_EXTSUM")
-    if extsum is not None and extsum.strip().lower() not in ("1", "true", "yes", "on"):
-        # ccache then hashes the non-reproducible .gch bytes: permanent misses
-        _LOGGER.warning("CCACHE_PCH_EXTSUM=%s disables pch caching", extsum)
-    env = {k: v for k, v in _CCACHE_PCH_ENV.items() if k not in os.environ}
-    user_sloppiness = os.environ.get("CCACHE_SLOPPINESS")
-    if user_sloppiness is not None and (
-        missing := [
-            t
-            for t in ("pch_defines", "time_macros")
-            if t not in {tok.strip() for tok in user_sloppiness.split(",")}
-        ]
-    ):
-        # Without these ccache declines every pch-consuming compile
-        env["CCACHE_SLOPPINESS"] = ",".join((user_sloppiness, *missing))
-        _LOGGER.warning(
-            "Adding %s to CCACHE_SLOPPINESS so ccache can cache compiles "
-            "that use the precompiled header",
-            ",".join(missing),
-        )
-    return env
-
-
-def pch_extra_scripts() -> list[str]:
-    """The extra_scripts entries a PlatformIO platform registers for the
-    pch; empty when disabled (the script itself has no enable check)."""
-    if not pch_enabled():
-        pch_disabled_degraded()
-        return []
-    return ["post:pch.py"]
-
-
-def pch_header_text(include_headers: Iterable[str]) -> str:
-    """The prefix-header source: exactly these includes, in order."""
-    return "".join(f'#include "{name}"\n' for name in include_headers)
-
-
-def _resolves(path: Path) -> bool:
-    """False when missing; other stat failures propagate (identity unknown,
-    unlike is_file(), which would silently drop the header)."""
-    try:
-        return stat.S_ISREG(path.stat().st_mode)
-    except (FileNotFoundError, NotADirectoryError):
-        return False
-
-
-def _include_closure(src_dir: Path, roots: Iterable[str]) -> dict[str, bytes]:
-    """Include closure of ``roots``: src-relative name -> contents.
-
-    Resolution mirrors the compiler (includer's dir, then src root); names
-    outside ``src_dir`` end the walk and are versioned by the caller. No
-    #ifdef evaluation: over-approximating is the safe direction.
-    """
-    seen: dict[str, bytes] = {}
-    stack: list[tuple[str, str]] = [(name, "") for name in roots]
-    while stack:
-        name, from_dir = stack.pop()
-        for candidate in (f"{from_dir}/{name}" if from_dir else name, name):
-            rel = posixpath.normpath(candidate)
-            if not rel.startswith("..") and _resolves(src_dir / rel):
-                break
-        else:
-            continue
-        if rel in seen:
-            continue
-        try:
-            data = (src_dir / rel).read_bytes()
-        except OSError as err:
-            # A marker would truncate the transitive walk; fail closed
-            _LOGGER.warning("Could not read %s for the pch checksum: %s", rel, err)
-            raise
-        seen[rel] = data
-        parent = posixpath.dirname(rel)
-        stack.extend(
-            # surrogateescape: a non-UTF-8 name just fails to resolve
-            (inc.decode(errors="surrogateescape"), parent)
-            for inc in _INCLUDE_RE.findall(data)
-        )
-    return seen
-
-
-def pch_checksum(
-    src_dir: Path, include_headers: Iterable[str], extra: Iterable[str]
-) -> str:
-    """Digest standing in for the .gch in ccache's hash: the include closure
-    of the prefix header plus caller-supplied identity strings (versioned
-    install paths, flags). Raises OSError when a header's identity cannot
-    be established at all; callers must then compile without a pch."""
-    digest = hashlib.sha256()
-    closure = _include_closure(src_dir, include_headers)
-    for name in sorted(closure):
-        digest.update(name.encode(errors="surrogateescape"))
-        digest.update(closure[name])
-        digest.update(b"\0")
-    for item in extra:
-        digest.update(item.encode(errors="surrogateescape"))
-        digest.update(b"\0")
-    return digest.hexdigest()
-
-
-# Tokens dropped when retargeting a TU's flags at the prefix header
-# (the pch compile must not touch depfiles)
-_PCH_STRIP_FLAGS_WITH_ARG = frozenset({"-o", "-c", "-MT", "-MF", "-MQ"})
-_PCH_STRIP_FLAGS = frozenset({"-MD", "-MMD", "-MP", "-MM", "-M"})
-
-
-def pch_compile_command(
-    build_dir: Path, header: Path, gch: Path
-) -> tuple[list[str], Path] | None:
-    """The exact src C++ flags from compile_commands.json retargeted at the
-    header, with the directory they resolve against (relative -I paths must
-    be expanded and executed from the same root); None (logged) when no
-    configured C++ TU is available yet."""
-    from esphome.core import CORE
-
-    try:
-        entries = json.loads(
-            (build_dir / "compile_commands.json").read_text(encoding="utf-8")
-        )
-    except (OSError, json.JSONDecodeError) as err:
-        # Configure already succeeded, so an unusable DB is a real anomaly
-        _LOGGER.warning("No usable compile database, skipping pch: %s", err)
-        return None
-    if not isinstance(entries, list):
-        _LOGGER.warning("Malformed compile database, skipping pch")
-        return None
-    # CMake may spell paths through a symlink differently than CORE does
-    # (macOS /tmp vs /private/tmp), so compare resolved paths
-    src_root = Path(CORE.relative_src_path()).resolve()
-    entry = next(
-        (
-            e
-            for e in entries
-            if isinstance(e, dict)
-            and isinstance(e.get("file"), str)
-            and e["file"].endswith(CXX_SOURCE_SUFFIXES)
-            and Path(e["file"]).resolve().is_relative_to(src_root)
-        ),
-        None,
-    )
-    if entry is None:
-        _LOGGER.warning("No src C++ entry in the compile database, skipping pch")
-        return None
-    directory = entry.get("directory")
-    cmd_dir = Path(directory) if isinstance(directory, str) and directory else build_dir
-    command = entry.get("command")
-    tokens = expand_response_files(
-        split_command(command if isinstance(command, str) else ""), cmd_dir
-    )
-    # A DB recorded with ccache enabled prefixes the compiler with the
-    # launcher; the .gch must be compiled directly
-    if tokens and is_launcher(tokens[0]):
-        tokens = tokens[1:]
-    if not tokens:
-        # "arguments"-style or empty entries must skip, not spawn "-x ..."
-        _LOGGER.warning("Compile database entry has no usable command, skipping pch")
-        return None
-    args: list[str] = []
-    arg_it = iter(tokens)
-    for tok in arg_it:
-        if tok in _PCH_STRIP_FLAGS_WITH_ARG:
-            next(arg_it, None)
-            continue
-        if tok in _PCH_STRIP_FLAGS:
-            continue
-        if tok == "-include":
-            # Drop only the injected prefix; user force-includes must reach
-            # the .gch compile or GCC rejects it over the macro mismatch
-            inc = next(arg_it, "")
-            if not inc.endswith(PCH_HEADER_NAME):
-                args.extend(("-include", inc))
-            continue
-        args.append(tok)
-    return [*args, "-x", "c++-header", "-c", str(header), "-o", str(gch)], cmd_dir
-
-
-def _log_pch_in_use() -> None:
-    # The only place a user can discover the knob; emitted only once a
-    # .gch is actually fresh or being built
-    _LOGGER.info(
-        "Compiling with a precompiled header (set ESPHOME_PCH_ENABLE=0 to disable)"
-    )
-
-
-def _read_stamp(path: Path) -> str:
-    """A corrupt sidecar must read as stale, not kill the pch forever."""
-    try:
-        return path.read_text(encoding="utf-8").strip()
-    except (OSError, UnicodeDecodeError):
-        return ""
-
-
-def discard_pch(build_dir: Path) -> None:
-    """Remove the pch sidecars so a stale .gch is never consumed.
-
-    Bumps the header only when a .gch was actually removed: TUs compiled
-    against it have incomplete depfiles, while a repeat failure with no
-    .gch must not force a full rebuild every build. A .gch that survives
-    an unlink failure would be consumed silently (wrong output, not a
-    slow build), so that raises.
-    """
-    header = build_dir / PCH_HEADER_NAME
-    gch = Path(f"{header}.gch")
-    had_gch = gch.is_file()
-    errors = []
-    for sidecar in (gch, Path(f"{gch}.sum")):
-        try:
-            sidecar.unlink(missing_ok=True)
-        except OSError as err:
-            if sidecar.is_file():
-                from esphome.core import EsphomeError
-
-                raise EsphomeError(
-                    f"Could not discard the stale precompiled header: {err}"
-                ) from err
-            errors.append(err)
-    for err in errors:
-        _LOGGER.warning("Could not discard the pch sidecars: %s", err)
-    if had_gch and header.is_file():
-        with suppress(OSError):
-            os.utime(header)
-
-
-def prepare_pch(
-    build_dir: Path, include_headers: tuple[str, ...], extra: Iterable[str]
-) -> None:
-    """Compile ``build_dir``'s .gch from compile_commands.json flags and
-    write its ccache .sum.
-
-    The .sum doubles as the freshness stamp and folds in the compile
-    command, so a flag-only change rebuilds the .gch; ``extra`` carries
-    backend identity (framework version, sdkconfig, ...). A failed
-    compile falls back to the plain header include.
-    """
-    from esphome.core import CORE
-
-    header = build_dir / PCH_HEADER_NAME
-    gch = Path(f"{header}.gch")
-    sum_path = Path(f"{gch}.sum")
-    cmd_and_dir = pch_compile_command(build_dir, header, gch)
-    if cmd_and_dir is None:
-        # Freshness cannot be validated; a leftover .gch must not be consumed
-        discard_pch(build_dir)
-        pch_degraded("no usable compile command")
-        return
-    cmd, cmd_dir = cmd_and_dir
-    # Strip like ccache's rewriting (user CCACHE_BASEDIR wins); the raw
-    # build path covers unresolved (symlinked) spellings
-    cmd_id = (
-        " ".join(cmd)
-        .replace(effective_ccache_basedir(), "")
-        .replace(str(CORE.build_path), "")
-    )
-    try:
-        checksum = pch_checksum(
-            CORE.relative_src_path(),
-            include_headers,
-            (
-                # The closure is sorted, so root order only enters via the text
-                pch_header_text(include_headers),
-                *extra,
-                cmd_id,
-            ),
-        )
-    except (OSError, UnicodeError) as err:
-        # Identity unknown: a stale cache entry must never be served
-        _LOGGER.warning(
-            "Could not establish the pch identity; compiling without it: %s", err
-        )
-        discard_pch(build_dir)
-        pch_degraded(f"identity unknown: {err}")
-        return
-    failed_marker = Path(f"{gch}.failed")
-
-    def _run(
-        run_cmd: list[str], what: str, stdin: str | None = None
-    ) -> subprocess.CompletedProcess | None:
-        """Spawn one pch tool step; environmental failures discard and
-        degrade (None): spawn/IO/timeout errors and signal kills never
-        latch the marker."""
-        try:
-            proc = subprocess.run(
-                run_cmd,
-                cwd=cmd_dir,
-                # C locale keeps diagnostics matchable by _TRANSIENT_ERRORS
-                env={**os.environ, "LC_ALL": "C"},
-                input=stdin,
-                capture_output=True,
-                text=True,
-                check=False,
-                timeout=300,
-            )
-        except (OSError, subprocess.SubprocessError) as err:
-            _LOGGER.warning("Precompiled header %s did not run: %s", what, err)
-            discard_pch(build_dir)
-            pch_degraded(f"{what} did not run: {err}")
-            return None
-        if proc.returncode < 0:
-            # Killed by a signal (OOM, ^C): environmental, do not latch
-            _LOGGER.warning(
-                "Precompiled header %s was killed (signal %d); retrying next build",
-                what,
-                -proc.returncode,
-            )
-            discard_pch(build_dir)
-            pch_degraded(f"{what} killed by signal {-proc.returncode}")
-            return None
-        return proc
-
-    def _fail(error: str, reason: str, latch: bool) -> None:
-        """Discard and degrade; deterministic failures latch when asked."""
-        _LOGGER.warning(
-            "Precompiled header failed; compiling without it: %s", error[:400]
-        )
-        # Latching paths keep the full compiler output recoverable
-        _LOGGER.debug("Full pch output: %s", error)
-        discard_pch(build_dir)
-        if latch and not any(m in error for m in _TRANSIENT_ERRORS):
-            # Skip retries until a header/flag/backend-identity/command change
-            failed_marker.write_text(checksum + "\n", encoding="utf-8")
-            os.utime(header)
-        pch_degraded(f"{reason}: {error[:200]}")
-
-    def _probe(latch: bool = True) -> None:
-        """Load-check the built .gch: some toolchains build one they then
-        refuse to load (per-process ASLR). Dep flags are already stripped
-        from cmd, so no -MF is needed; cmd ends with the fixed
-        "-x c++-header -c -o" tail. A cached-header rejection may not
-        reproduce (per-process), so that caller passes latch=False."""
-        if cmd[-6:-4] != ["-x", "c++-header"]:
-            # The slice below depends on pch_compile_command's fixed tail
-            _LOGGER.warning("Unexpected pch command shape: %s", cmd[-6:])
-            discard_pch(build_dir)
-            pch_degraded("unexpected pch command shape")
-            return
-        base = cmd[:-6]
-        probe = _run([*base, *pch_probe_args(str(header))], "probe", stdin="")
-        if probe is None:
-            return
-        if probe.returncode != 0:
-            # Disambiguate: only blame the pch when the same compile passes
-            # without it; a failing baseline is its own (latchable) problem
-            baseline = _run([*base, *pch_probe_tail()], "probe baseline", stdin="")
-            if baseline is None:
-                return
-            if baseline.returncode == 0:
-                error = probe.stderr.strip() or f"exit code {probe.returncode}"
-                _fail(error, "toolchain cannot load the pch", latch=latch)
-            else:
-                error = baseline.stderr.strip() or f"exit code {baseline.returncode}"
-                _fail(error, "probe cannot run at all", latch=latch)
-
-    if gch.is_file() and _read_stamp(sum_path) == checksum:
-        _log_pch_in_use()
-        if pch_strict():
-            # Rejection is per-process, so a cached .gch must re-prove
-            # loadability for the strict gate (CI-only cost); no latch,
-            # since the rejection may not reproduce either
-            _probe(latch=False)
-        return
-    if _read_stamp(failed_marker) == checksum:
-        _LOGGER.info(
-            "Precompiled header disabled after an earlier failure; delete %s to retry",
-            failed_marker,
-        )
-        pch_degraded("earlier failure latched")
-        return
-    _log_pch_in_use()
-    result = _run(cmd, "compile")
-    if result is None:
-        return
-    error = None
-    if result.returncode != 0:
-        error = result.stderr.strip() or f"exit code {result.returncode}"
-    elif not gch.is_file():
-        error = "compiler produced no .gch"
-    if error is not None:
-        _fail(error, "compile failed", latch=True)
-        return
-    _probe()
-    if not gch.is_file():
-        # The probe discarded a rejected or unrunnable .gch
-        return
-    failed_marker.unlink(missing_ok=True)
-    sum_path.write_text(checksum + "\n", encoding="utf-8")
-    # Consumers depend on the header (depfiles cannot see through a .gch);
-    # bump it so users of the previous .gch recompile
-    os.utime(header)

esphome/components/api/__init__.py

@@ -14,6 +14,7 @@ from esphome.components.noise import (  # noqa: F401
     ENCRYPTION_SCHEMA,
     decode_encryption_key,
     encryption_schema,
+    new_psk_progmem,
     validate_encryption_key,
 )
 from esphome.config_helpers import filter_source_files_from_defines, get_logger_level
@@ -589,8 +590,7 @@ async def to_code(config: ConfigType) -> None:
 
     if (encryption_config := config.get(CONF_ENCRYPTION, None)) is not None:
         if key := encryption_config.get(CONF_KEY):
-            decoded = decode_encryption_key(key)
-            cg.add(var.set_noise_psk(list(decoded)))
+            cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], key)))
             cg.add_define("USE_API_NOISE_PSK_FROM_YAML")
         else:
             # No key provided, but encryption desired

esphome/components/api/api_connection.cpp

@@ -2161,7 +2161,10 @@ void APIConnection::on_homeassistant_action_response(const HomeassistantActionRe
 bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptionSetKeyRequest &msg) {
   NoiseEncryptionSetKeyResponse resp;
   resp.success = false;
-
+#ifdef USE_API_NOISE_PSK_FROM_YAML
+  // A yaml key cannot be changed at runtime, so no decode or save path is built
+  ESP_LOGW(TAG, "Key set in YAML");
+#else
 #ifdef USE_PROVISIONING
   // Refuse to set a key once the provisioning window has closed (defense in depth;
   // such connections are already rejected at hello).
@@ -2196,6 +2199,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
     }
 #endif
   }
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 
   return this->send_message(resp);
 }

esphome/components/api/api_frame_helper_noise.cpp

@@ -548,7 +548,7 @@ APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
  * @return 0 on success, -1 on error (check errno)
  */
 APIError APINoiseFrameHelper::init_handshake_() {
-  int err = this->handshake_.init(this->ctx_.get_psk(), prologue_.data(), prologue_.size());
+  int err = this->handshake_.init(this->ctx_, prologue_.data(), prologue_.size());
   APIError aerr = handle_noise_error_(err, LOG_STR("noise_handshake_init"), APIError::HANDSHAKESTATE_SETUP_FAILED);
   if (aerr != APIError::OK)
     return aerr;

esphome/components/api/api_server.cpp

@@ -41,13 +41,13 @@ void APIServer::setup() {
   ControllerRegistry::register_controller(this);
 
 #ifdef USE_API_NOISE
+  // Always reserve the slot: flash preferences are positional on esp8266, so
+  // a yaml key build must keep the layout of a runtime key build
   uint32_t hash = 88491486UL;
-
   this->noise_pref_ = global_preferences->make_preference<SavedNoisePsk>(hash, true);
-
 #ifndef USE_API_NOISE_PSK_FROM_YAML
-  // Only load saved PSK if not set from YAML
-  if (this->load_and_apply_noise_psk_()) {
+  // A cleared record loads fine but holds no key
+  if (this->load_and_apply_noise_psk_() && this->noise_ctx_.has_psk()) {
     ESP_LOGD(TAG, "Loaded saved Noise PSK");
   }
 #endif
@@ -550,6 +550,7 @@ const std::vector<APIServer::HomeAssistantStateSubscription> &APIServer::get_sta
 #endif
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
 bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString *save_log_msg,
                                   const LogString *fail_log_msg, bool make_active) {
   if (!this->noise_pref_.save(&new_psk)) {
@@ -583,22 +584,19 @@ bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString
 }
 
 bool APIServer::load_and_apply_noise_psk_() {
-  SavedNoisePsk saved{};
-  if (!this->noise_pref_.load(&saved))
+  // Load into a temp so a failed read cannot disturb the key in use
+  SavedNoisePsk loaded{};
+  if (!this->noise_pref_.load(&loaded))
     return false;
-  this->set_noise_psk(saved.psk);
+  this->saved_psk_ = loaded;
+  // An unprovisioned device stores the reserved all-zeros key, which is no key
+  const bool has_key = !noise::NoiseContext::is_all_zeros(this->saved_psk_.psk);
+  this->noise_ctx_.set_psk(has_key ? this->saved_psk_.psk.data() : nullptr);
   return true;
 }
 
 bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
-#ifdef USE_API_NOISE_PSK_FROM_YAML
-  // When PSK is set from YAML, this function should never be called
-  // but if it is, reject the change
-  ESP_LOGW(TAG, "Key set in YAML");
-  return false;
-#else
-  auto &old_psk = this->noise_ctx_.get_psk();
-  if (std::equal(old_psk.begin(), old_psk.end(), psk.begin())) {
+  if (this->saved_psk_.psk == psk) {
     ESP_LOGW(TAG, "New PSK matches old");
     return true;
   }
@@ -614,15 +612,8 @@ bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
   }
 #endif
   return result;
-#endif
 }
 bool APIServer::clear_noise_psk(bool make_active) {
-#ifdef USE_API_NOISE_PSK_FROM_YAML
-  // When PSK is set from YAML, this function should never be called
-  // but if it is, reject the change
-  ESP_LOGW(TAG, "Key set in YAML");
-  return false;
-#else
   SavedNoisePsk empty_psk{};
   bool result = this->update_noise_psk_(empty_psk, LOG_STR("Noise PSK cleared"), LOG_STR("Failed to clear Noise PSK"),
                                         make_active);
@@ -634,8 +625,8 @@ bool APIServer::clear_noise_psk(bool make_active) {
   }
 #endif
   return result;
-#endif
 }
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 #endif
 
 #ifdef USE_HOMEASSISTANT_TIME

esphome/components/api/api_server.h

@@ -76,9 +76,14 @@ class APIServer final : public Component,
   APIBuffer &get_shared_buffer_ref() { return shared_write_buffer_; }
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
+  // Runtime key changes exist for the provisioning path only (not lambdas);
+  // with a yaml key they compile out
   bool save_noise_psk(noise::psk_t psk, bool make_active = true);
   bool clear_noise_psk(bool make_active = true);
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
+#endif
+  /// psk points at 32 bytes that live in flash for the life of the program
+  void set_noise_psk(const uint8_t *psk) { this->noise_ctx_.set_psk(psk); }
   noise::NoiseContext &get_noise_ctx() { return this->noise_ctx_; }
 #endif  // USE_API_NOISE
 
@@ -275,10 +280,12 @@ class APIServer final : public Component,
 #endif
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
   bool update_noise_psk_(const SavedNoisePsk &new_psk, const LogString *save_log_msg, const LogString *fail_log_msg,
                          bool make_active);
   // Load saved PSK from preferences and apply it. Returns true on success.
   bool load_and_apply_noise_psk_();
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 #endif  // USE_API_NOISE
 #ifdef USE_API_HOMEASSISTANT_STATES
   // Helper methods to reduce code duplication
@@ -358,6 +365,9 @@ class APIServer final : public Component,
 
 #ifdef USE_API_NOISE
   noise::NoiseContext noise_ctx_;
+#ifndef USE_API_NOISE_PSK_FROM_YAML
+  SavedNoisePsk saved_psk_{};  // backs noise_ctx_ for a runtime provisioned key
+#endif
   ESPPreferenceObject noise_pref_;
 #endif  // USE_API_NOISE
 };

esphome/components/esp32_ble/ble.cpp

@@ -100,21 +100,38 @@ void ESP32BLE::disable() {
 #ifdef USE_ESP32_BLE_ADVERTISING
 void ESP32BLE::advertising_start() {
   this->advertising_init_();
-  if (!this->is_active())
+  this->advertising_ref_count_++;
+  this->advertising_refresh();
+}
+
+void ESP32BLE::advertising_stop() {
+  if (this->advertising_ref_count_ == 0)
     return;
-  this->advertising_->start();
+  this->advertising_ref_count_--;
+  this->advertising_refresh();
+}
+
+void ESP32BLE::advertising_refresh() {
+  if (this->advertising_ == nullptr || !this->is_active())
+    return;
+  // Advertise while any component still needs it, otherwise stop
+  if (this->advertising_ref_count_ == 0) {
+    this->advertising_->stop();
+  } else {
+    this->advertising_->start();
+  }
 }
 
 void ESP32BLE::advertising_set_service_data(const std::vector<uint8_t> &data) {
   this->advertising_init_();
   this->advertising_->set_service_data(data);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_set_manufacturer_data(const std::vector<uint8_t> &data) {
   this->advertising_init_();
   this->advertising_->set_manufacturer_data(data);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_set_service_data_and_name(std::span<const uint8_t> data, bool include_name) {
@@ -136,7 +153,7 @@ void ESP32BLE::advertising_set_service_data_and_name(std::span<const uint8_t> da
     this->advertising_->set_service_data(data);
   }
 
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_register_raw_advertisement_callback(std::function<void(bool)> &&callback) {
@@ -147,13 +164,13 @@ void ESP32BLE::advertising_register_raw_advertisement_callback(std::function<voi
 void ESP32BLE::advertising_add_service_uuid(ESPBTUUID uuid) {
   this->advertising_init_();
   this->advertising_->add_service_uuid(uuid);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_remove_service_uuid(ESPBTUUID uuid) {
   this->advertising_init_();
   this->advertising_->remove_service_uuid(uuid);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 #endif
 
@@ -575,6 +592,10 @@ void ESP32BLE::loop_handle_state_transition_not_active_() {
     }
 
     this->state_ = BLE_COMPONENT_STATE_ACTIVE;
+#ifdef USE_ESP32_BLE_ADVERTISING
+    // Requests made before the stack was up (or before it was re-enabled) take effect now
+    this->advertising_refresh();
+#endif
   }
 }
 

esphome/components/esp32_ble/ble.h

@@ -114,7 +114,17 @@ class ESP32BLE final : public Component {
   void set_name(const char *name) { this->name_ = name; }
 
 #ifdef USE_ESP32_BLE_ADVERTISING
+  /** Request advertising on behalf of a component.
+   *
+   * Requests are reference counted: advertising runs until every component that called
+   * advertising_start() has released it again with advertising_stop(). Each component must
+   * pair its calls, so nothing advertises until something actually asks for it.
+   */
   void advertising_start();
+  /// Release a request made with advertising_start(); advertising stops at the last release.
+  void advertising_stop();
+  /// Apply the current payload and request count: advertise while requested, otherwise stop.
+  void advertising_refresh();
   void advertising_set_service_data(const std::vector<uint8_t> &data);
   void advertising_set_manufacturer_data(const std::vector<uint8_t> &data);
   void advertising_set_appearance(uint16_t appearance) { this->appearance_ = appearance; }
@@ -226,6 +236,9 @@ class ESP32BLE final : public Component {
   // 1-byte aligned members (grouped together to minimize padding)
   BLEComponentState state_{BLE_COMPONENT_STATE_OFF};  // 1 byte (uint8_t enum)
   bool enable_on_boot_{};                             // 1 byte
+#ifdef USE_ESP32_BLE_ADVERTISING
+  uint8_t advertising_ref_count_{0};  // 1 byte, number of components requesting advertising
+#endif
 
 #ifdef ESPHOME_ESP32_BLE_EXTENDED_AUTH_PARAMS
   optional<esp_ble_auth_req_t> auth_req_mode_;

esphome/components/esp32_ble_beacon/esp32_ble_beacon.cpp

@@ -67,6 +67,8 @@ void ESP32BLEBeacon::setup() {
       this->on_advertise_();
     }
   });
+  // A beacon always needs the device to advertise, and never releases the request
+  global_ble->advertising_start();
 }
 
 void ESP32BLEBeacon::on_advertise_() {

esphome/components/esp32_ble_server/__init__.py

@@ -596,6 +596,18 @@ async def to_code(config):
     cg.add(var.set_parent(parent))
     cg.add(parent.advertising_set_appearance(config[CONF_APPEARANCE]))
     cg.add(var.set_max_clients(config[CONF_MAX_CLIENTS]))
+    # Only advertise for the server itself when the configuration gives clients something to
+    # find. A server that is auto-loaded purely to host a runtime service (esp32_improv) stays
+    # silent until that service asks for advertising.
+    cg.add(
+        var.set_advertising_required(
+            CONF_MANUFACTURER_DATA in config
+            or any(
+                not uuid_is(service_config[CONF_UUID], DEVICE_INFORMATION_SERVICE_UUID)
+                for service_config in config[CONF_SERVICES]
+            )
+        )
+    )
     if CONF_MANUFACTURER_DATA in config:
         cg.add(var.set_manufacturer_data(config[CONF_MANUFACTURER_DATA]))
     for service_config in config[CONF_SERVICES]:

esphome/components/esp32_ble_server/ble_server.cpp

@@ -81,6 +81,7 @@ void BLEServer::loop() {
       if (this->device_information_service_->is_running()) {
         this->state_ = RUNNING;
         this->restart_advertising_();
+        this->request_advertising_();
         ESP_LOGD(TAG, "BLE server setup successfully");
       } else if (this->device_information_service_->is_created()) {
         this->device_information_service_->start();
@@ -98,6 +99,20 @@ void BLEServer::restart_advertising_() {
   }
 }
 
+void BLEServer::request_advertising_() {
+  if (!this->advertising_required_ || this->advertising_requested_)
+    return;
+  this->advertising_requested_ = true;
+  this->parent_->advertising_start();
+}
+
+void BLEServer::release_advertising_() {
+  if (!this->advertising_requested_)
+    return;
+  this->advertising_requested_ = false;
+  this->parent_->advertising_stop();
+}
+
 BLEService *BLEServer::create_service(ESPBTUUID uuid, bool advertise, uint16_t num_handles) {
 #if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE
   char uuid_buf[esp32_ble::UUID_STR_LEN];
@@ -170,7 +185,7 @@ void BLEServer::gatts_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_t ga
       this->add_client_(param->connect.conn_id);
       // Resume advertising so additional clients can discover and connect
       if (this->client_count_ < this->max_clients_) {
-        this->parent_->advertising_start();
+        this->parent_->advertising_refresh();
       }
       this->dispatch_callbacks_(CallbackType::ON_CONNECT, param->connect.conn_id);
       break;
@@ -178,7 +193,7 @@ void BLEServer::gatts_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_t ga
     case ESP_GATTS_DISCONNECT_EVT: {
       ESP_LOGD(TAG, "BLE Client disconnected");
       this->remove_client_(param->disconnect.conn_id);
-      this->parent_->advertising_start();
+      this->parent_->advertising_refresh();
       this->dispatch_callbacks_(CallbackType::ON_DISCONNECT, param->disconnect.conn_id);
       break;
     }
@@ -226,6 +241,8 @@ void BLEServer::remove_client_(uint16_t conn_id) {
 }
 
 void BLEServer::ble_before_disabled_event_handler() {
+  // Advertising is re-requested once the server is running again after BLE is re-enabled
+  this->release_advertising_();
   // Delete all clients
   this->client_count_ = 0;
   // Delete all services

esphome/components/esp32_ble_server/ble_server.h

@@ -38,6 +38,13 @@ class BLEServer final : public Component, public Parented<ESP32BLE> {
     this->restart_advertising_();
   }
 
+  /** Whether this server needs the device to advertise so clients can find and connect to it.
+   *
+   * False for a server that only hosts services created at runtime (e.g. esp32_improv), which
+   * request advertising themselves for as long as they need it.
+   */
+  void set_advertising_required(bool required) { this->advertising_required_ = required; }
+
   void set_max_clients(uint8_t max_clients) { this->max_clients_ = max_clients; }
   uint8_t get_max_clients() const { return this->max_clients_; }
 
@@ -82,6 +89,8 @@ class BLEServer final : public Component, public Parented<ESP32BLE> {
   };
 
   void restart_advertising_();
+  void request_advertising_();
+  void release_advertising_();
 
   int8_t find_client_index_(uint16_t conn_id) const;
   void add_client_(uint16_t conn_id);
@@ -93,6 +102,8 @@ class BLEServer final : public Component, public Parented<ESP32BLE> {
   std::vector<uint8_t> manufacturer_data_{};
   esp_gatt_if_t gatts_if_{0};
   bool registered_{false};
+  bool advertising_required_{true};
+  bool advertising_requested_{false};
 
   uint16_t clients_[USE_ESP32_BLE_MAX_CONNECTIONS]{};
   uint8_t client_count_{0};

esphome/components/esp32_improv/esp32_improv_component.cpp

@@ -112,6 +112,7 @@ void ESP32ImprovComponent::loop() {
       this->state_callback_.call(this->state_, this->error_state_);
 #endif
     }
+    this->release_advertising_();
     this->incoming_data_.clear();
     return;
   }
@@ -143,8 +144,9 @@ void ESP32ImprovComponent::loop() {
           ESP_LOGV(TAG, "Starting with device name advertising");
           this->advertising_device_name_ = true;
           this->last_name_adv_time_ = App.get_loop_component_start_time();
+          // Set the payload before requesting, so advertising starts exactly once
           esp32_ble::global_ble->advertising_set_service_data_and_name(std::span<const uint8_t>{}, true);
-          esp32_ble::global_ble->advertising_start();
+          this->request_advertising_();
 
           // Set initial state based on whether we have an authorizer
           this->set_state_(this->get_initial_state_(), false);
@@ -326,6 +328,8 @@ void ESP32ImprovComponent::stop() {
   this->set_timeout("end-service", STOP_ADVERTISING_DELAY, [this] {
     if (this->state_ == improv::STATE_STOPPED || this->service_ == nullptr)
       return;
+    // Release first so removing the service UUID does not restart advertising on the way out
+    this->release_advertising_();
     this->service_->stop();
     this->set_state_(improv::STATE_STOPPED);
   });
@@ -520,6 +524,20 @@ void ESP32ImprovComponent::update_advertising_type_() {
   }
 }
 
+void ESP32ImprovComponent::request_advertising_() {
+  if (this->advertising_requested_)
+    return;
+  this->advertising_requested_ = true;
+  esp32_ble::global_ble->advertising_start();
+}
+
+void ESP32ImprovComponent::release_advertising_() {
+  if (!this->advertising_requested_)
+    return;
+  this->advertising_requested_ = false;
+  esp32_ble::global_ble->advertising_stop();
+}
+
 improv::State ESP32ImprovComponent::get_initial_state_() const {
 #ifdef USE_BINARY_SENSOR
   // If we have an authorizer, start in awaiting authorization state

esphome/components/esp32_improv/esp32_improv_component.h

@@ -104,8 +104,11 @@ class ESP32ImprovComponent final : public Component, public improv_base::ImprovB
   bool status_indicator_state_{false};
   uint32_t last_name_adv_time_{0};
   bool advertising_device_name_{false};
+  bool advertising_requested_{false};
   void set_status_indicator_state_(bool state);
   void update_advertising_type_();
+  void request_advertising_();
+  void release_advertising_();
 
   void set_state_(improv::State state, bool update_advertising = true);
   void set_error_(improv::Error error);

esphome/components/esp8266/__init__.py

@@ -3,10 +3,8 @@ from pathlib import Path
 import platform
 import re
 import subprocess
-import time
 from typing import Any
 
-from esphome.build_helpers.pch import pch_extra_scripts
 import esphome.codegen as cg
 import esphome.config_validation as cv
 from esphome.const import (
@@ -16,7 +14,6 @@ from esphome.const import (
     CONF_FRAMEWORK,
     CONF_PLATFORM_VERSION,
     CONF_SOURCE,
-    CONF_TOOLCHAIN,
     CONF_VERSION,
     KEY_CORE,
     KEY_FRAMEWORK_VERSION,
@@ -24,7 +21,6 @@ from esphome.const import (
     KEY_TARGET_PLATFORM,
     PLATFORM_ESP8266,
     ThreadModel,
-    Toolchain,
 )
 from esphome.core import (
     CORE,
@@ -35,13 +31,12 @@ from esphome.core import (
 )
 from esphome.core.config import BOARD_MAX_LENGTH
 from esphome.helpers import IS_MACOS, copy_file_if_changed
-from esphome.platformio.toolchain import copy_ccache_script, copy_pch_script
+from esphome.platformio.toolchain import copy_ccache_script
 from esphome.storage_json import StorageJSON
 from esphome.types import ConfigType
 
-from .boards import BOARDS, ESP8266_BOARD_BUILD, board_ld_script
+from .boards import BOARDS, board_ld_script
 from .const import (
-    BUILD_FLASH_MODES,
     CONF_EARLY_PIN_INIT,
     CONF_ENABLE_SERIAL,
     CONF_ENABLE_SERIAL1,
@@ -49,7 +44,6 @@ from .const import (
     KEY_BOARD,
     KEY_ESP8266,
     KEY_PIN_INITIAL_STATES,
-    KEY_SCANF_FLOAT,
     KEY_SERIAL1_REQUIRED,
     KEY_SERIAL_REQUIRED,
     KEY_WAVEFORM_REQUIRED,
@@ -109,53 +103,6 @@ def set_core_data(config: ConfigType) -> ConfigType:
     return config
 
 
-_TOOLCHAINS = (Toolchain.PLATFORMIO, Toolchain.ARDUINO)
-_validate_toolchain = cv.toolchain_enum(_TOOLCHAINS)
-_resolve_toolchain = cv.resolve_toolchain("ESP8266", _TOOLCHAINS, Toolchain.PLATFORMIO)
-
-
-def _validate_native_toolchain(config: ConfigType) -> ConfigType:
-    """Constraints of the native (non-PlatformIO) Arduino toolchain."""
-    if not CORE.using_toolchain_arduino:
-        return config
-    from esphome.arduino8266.framework import MIN_FRAMEWORK_VERSION
-
-    conf = config[CONF_FRAMEWORK]
-    version = cv.Version.parse(conf[CONF_VERSION])
-    if version < MIN_FRAMEWORK_VERSION:
-        raise cv.Invalid(
-            "'toolchain: arduino' requires framework version "
-            f"{MIN_FRAMEWORK_VERSION} or newer"
-        )
-    # platform_version is a PlatformIO concept; drop it (as esp32's native
-    # toolchain does), warning when a custom pin is discarded. The floor
-    # above guarantees the schema-derived default is the ARDUINO_4 spec.
-    if (
-        conf.pop(CONF_PLATFORM_VERSION, _ARDUINO_4_PLATFORM_SPEC)
-        != _ARDUINO_4_PLATFORM_SPEC
-    ):
-        _LOGGER.warning(
-            "'platform_version' is ignored by 'toolchain: arduino'; the native "
-            "toolchain downloads the framework and compiler directly"
-        )
-    if conf[CONF_SOURCE] != _format_framework_arduino_version(version):
-        raise cv.Invalid(
-            "'toolchain: arduino' does not support a custom framework source; "
-            "use 'toolchain: platformio'"
-        )
-    # BOARDS is a subset of ESP8266_BOARD_BUILD today; the second clause is
-    # a drift guard for the independently regenerated tables
-    if (
-        config[CONF_BOARD] not in BOARDS
-        or config[CONF_BOARD] not in ESP8266_BOARD_BUILD
-    ):
-        raise cv.Invalid(
-            f"Board '{config[CONF_BOARD]}' is not supported by "
-            "'toolchain: arduino'; use 'toolchain: platformio'"
-        )
-    return config
-
-
 def get_download_types(storage_json: StorageJSON) -> list[dict[str, str]]:
     """Binary-download entries for a built ESP8266 firmware.
 
@@ -185,7 +132,7 @@ def _format_framework_arduino_version(ver: cv.Version) -> str:
     # a PIO platformio/framework-arduinoespressif8266 value
     # List of package versions: https://api.registry.platformio.org/v3/packages/platformio/tool/framework-arduinoespressif8266
     # Same encoding the native toolchain uses for its package download, so a
-    # custom-source check against this value cannot drift from what it fetches.
+    # version bump cannot drift between the two paths.
     from esphome.arduino8266.framework import framework_package_version
 
     try:
@@ -247,7 +194,7 @@ def _arduino_check_versions(value: ConfigType) -> ConfigType:
     platform_version = value.get(CONF_PLATFORM_VERSION)
     if platform_version is None:
         if version >= cv.Version(3, 1, 0):
-            platform_version = _ARDUINO_4_PLATFORM_SPEC
+            platform_version = _parse_platform_version(str(ARDUINO_4_PLATFORM_VERSION))
         else:
             platform_version = _parse_platform_version(str(ARDUINO_3_PLATFORM_VERSION))
     value[CONF_PLATFORM_VERSION] = platform_version
@@ -270,10 +217,6 @@ def _parse_platform_version(value: Any) -> str:
         return value
 
 
-# The platform_version derived for every core >= 3.1.0 config
-_ARDUINO_4_PLATFORM_SPEC = _parse_platform_version(str(ARDUINO_4_PLATFORM_VERSION))
-
-
 ARDUINO_FRAMEWORK_SCHEMA = cv.All(
     cv.Schema(
         {
@@ -290,6 +233,7 @@ ARDUINO_FRAMEWORK_SCHEMA = cv.All(
 )
 
 
+BUILD_FLASH_MODES = ["qio", "qout", "dio", "dout"]
 CONFIG_SCHEMA = cv.All(
     cv.Schema(
         {
@@ -306,30 +250,15 @@ CONFIG_SCHEMA = cv.All(
             cv.Optional(CONF_ENABLE_SERIAL1): cv.boolean,
             cv.Optional(CONF_ENABLE_FULL_PRINTF, default=False): cv.boolean,
             cv.Optional(CONF_ENABLE_SCANF_FLOAT): cv.boolean,
-            cv.Optional(
-                CONF_TOOLCHAIN, visibility=cv.Visibility.ADVANCED
-            ): _validate_toolchain,
         }
     ),
-    _resolve_toolchain,
-    _validate_native_toolchain,
+    # Until the native toolchain lands, PlatformIO is the only backend;
+    # reject a --toolchain this platform cannot serve yet.
+    cv.require_platformio_toolchain("ESP8266"),
     set_core_data,
 )
 
 
-def native_toolchain_module():
-    """The native build backend for the resolved toolchain, if any.
-
-    ``__main__`` dispatches from its own toolchain-keyed table; this helper
-    serves the component's internal callers.
-    """
-    if not CORE.using_toolchain_arduino:
-        return None
-    from esphome.arduino8266 import toolchain
-
-    return toolchain
-
-
 def check_rosetta() -> None:
     """Fail fast when the x86_64 ESP8266 toolchain cannot run on this Mac.
 
@@ -365,13 +294,12 @@ def _choose_ld_script(board: str) -> str:
 
 @coroutine_with_priority(CoroPriority.PLATFORM)
 async def to_code(config: ConfigType) -> None:
-    use_platformio = CORE.using_toolchain_platformio
     cg.add(esp8266_ns.setup_preferences())
 
-    if use_platformio:
-        cg.add_platformio_option("lib_ldf_mode", "off")
-        cg.add_platformio_option("lib_compat_mode", "strict")
-        cg.add_platformio_option("board", config[CONF_BOARD])
+    cg.add_platformio_option("lib_ldf_mode", "off")
+    cg.add_platformio_option("lib_compat_mode", "strict")
+
+    cg.add_platformio_option("board", config[CONF_BOARD])
     cg.add_build_flag("-DUSE_ESP8266")
     cg.set_cpp_standard("gnu++20")
     cg.add_define("ESPHOME_BOARD", config[CONF_BOARD])
@@ -387,33 +315,28 @@ async def to_code(config: ConfigType) -> None:
             "enabling scanf float support (~8KB flash)"
         )
 
-    # The native generator reads the same decision (KEY_SCANF_FLOAT)
-    CORE.data[KEY_ESP8266][KEY_SCANF_FLOAT] = bool(enable_scanf_float)
-    if use_platformio:
-        extra_scripts = [
-            "pre:ccache.py",
-            "pre:testing_mode.py",
-            "pre:exclude_updater.py",
-            "pre:exclude_waveform.py",
-            "pre:relocate_ratetable.py",
-        ]
-        if not enable_scanf_float:
-            extra_scripts.append("pre:remove_float_scanf.py")
-        extra_scripts.extend(pch_extra_scripts())
-        extra_scripts.append("post:post_build.py")
-        cg.add_platformio_option("extra_scripts", extra_scripts)
+    extra_scripts = [
+        "pre:ccache.py",
+        "pre:testing_mode.py",
+        "pre:exclude_updater.py",
+        "pre:exclude_waveform.py",
+        "pre:relocate_ratetable.py",
+    ]
+    if not enable_scanf_float:
+        extra_scripts.append("pre:remove_float_scanf.py")
+    extra_scripts.append("post:post_build.py")
+    cg.add_platformio_option("extra_scripts", extra_scripts)
 
     conf = config[CONF_FRAMEWORK]
+    cg.add_platformio_option("framework", "arduino")
     cg.add_build_flag("-DUSE_ARDUINO")
     cg.add_build_flag("-DUSE_ESP8266_FRAMEWORK_ARDUINO")
     cg.add_build_flag("-Wno-nonnull-compare")
-    if use_platformio:
-        cg.add_platformio_option("framework", "arduino")
-        cg.add_platformio_option("platform", conf[CONF_PLATFORM_VERSION])
-        cg.add_platformio_option(
-            "platform_packages",
-            [f"platformio/framework-arduinoespressif8266@{conf[CONF_SOURCE]}"],
-        )
+    cg.add_platformio_option("platform", conf[CONF_PLATFORM_VERSION])
+    cg.add_platformio_option(
+        "platform_packages",
+        [f"platformio/framework-arduinoespressif8266@{conf[CONF_SOURCE]}"],
+    )
 
     # Default for platformio is LWIP2_LOW_MEMORY with:
     #  - MSS=536
@@ -451,8 +374,7 @@ async def to_code(config: ConfigType) -> None:
     # Force-include inline std::__throw_* overrides so GCC dead-strips the unused
     # libstdc++ error message strings (e.g. "basic_string::_M_create") from DRAM.
     # See throw_stubs.h for details. Must be prepended before <string>, so this
-    # uses build_src_flags with -include. Unconditional: the native build
-    # generator reads the same option, keeping one source of truth.
+    # uses build_src_flags with -include.
     cg.add_platformio_option(
         "build_src_flags", "-include esphome/components/esp8266/throw_stubs.h"
     )
@@ -482,8 +404,6 @@ async def to_code(config: ConfigType) -> None:
     # implementation in the Arduino ESP8266 core.
     cg.add_build_flag("-Wl,--wrap=millis")
 
-    # Unconditional: the native build generator reads the same option,
-    # keeping one source of truth
     cg.add_platformio_option("board_build.flash_mode", config[CONF_BOARD_FLASH_MODE])
 
     ver: cv.Version = CORE.data[KEY_CORE][KEY_FRAMEWORK_VERSION]
@@ -492,7 +412,7 @@ async def to_code(config: ConfigType) -> None:
         cg.RawExpression(f"VERSION_CODE({ver.major}, {ver.minor}, {ver.patch})"),
     )
 
-    if use_platformio and config[CONF_BOARD] in BOARDS:
+    if config[CONF_BOARD] in BOARDS:
         cg.add_platformio_option(
             "board_build.ldscript", _choose_ld_script(config[CONF_BOARD])
         )
@@ -533,24 +453,8 @@ async def finalize_serial_config() -> None:
         cg.add_build_flag("-DNO_GLOBAL_SERIAL1")
 
 
-# Called by __main__.compile_program; returning False falls through to the
-# PlatformIO toolchain.
-def run_compile(args, config: ConfigType) -> bool:
-    # Positive check: the native backend only runs when explicitly resolved
-    toolchain = native_toolchain_module()
-    if toolchain is None:
-        return False
-    if toolchain.run_compile(config, CORE.verbose) != 0:
-        raise EsphomeError("ESP8266 native build failed")
-    return True
-
-
 # Called by writer.py
 def copy_files() -> None:
-    # Native builds skip the PlatformIO extra scripts; the build generator
-    # carries their logic
-    if CORE.using_toolchain_arduino:
-        return
     dir = Path(__file__).parent
     for script in (
         "post_build",
@@ -565,7 +469,6 @@ def copy_files() -> None:
             CORE.relative_build_path(f"{script}.py"),
         )
     copy_ccache_script()
-    copy_pch_script()
 
 
 # ESP logs stack trace decoder, based on https://github.com/me-no-dev/EspExceptionDecoder
@@ -608,75 +511,22 @@ ESP8266_EXCEPTION_CODES = {
 }
 
 
-_DECODE_WARNED_AT: dict[str, float] = {}
+def _decode_pc(config: ConfigType, addr: str) -> None:
+    from esphome.platformio import toolchain
 
-
-def _warn_decode_problem(key: str, message: str, *args) -> bool:
-    """Warn, deduplicated briefly so a burst of stack-dump addresses warns
-    once but a later dump warns again; returns whether it warned so the
-    caller can mark suppressed addresses individually."""
-    now = time.monotonic()
-    last = _DECODE_WARNED_AT.get(key)
-    if last is not None and now - last < 30:
-        return False
-    _DECODE_WARNED_AT[key] = now
-    _LOGGER.warning(message, *args)
-    return True
-
-
-def _decode_pc(config: ConfigType, addr: str, *, bulk: bool = False) -> None:
-    """Decode one crash address. ``bulk``: the caller is scanning every
-    8-hex stack word, most of which are not code addresses -- unmappable
-    ones log at debug so real frames are not buried."""
-    if (native_toolchain := native_toolchain_module()) is not None:
-        addr2line = native_toolchain.get_addr2line_path()
-        elf = native_toolchain.get_elf_path()
-        for path in (addr2line, elf):
-            if not path.is_file():
-                _warn_decode_problem(
-                    str(path), "Cannot decode crash addresses: %s missing", path
-                )
-                # The detailed warning names no address; mark named
-                # registers, but bulk stack words at debug (~150 per dump)
-                log = _LOGGER.debug if bulk else _LOGGER.warning
-                log("Not decoded %s (toolchain file missing)", addr)
-                return
-        addr2line, elf = str(addr2line), str(elf)
-    else:
-        from esphome.platformio import toolchain
-
-        idedata = toolchain.get_idedata(config)
-        if not idedata.addr2line_path or not idedata.firmware_elf_path:
-            _warn_decode_problem(
-                "no-addr2line",
-                "Cannot decode crash addresses: no addr2line or ELF in idedata",
-            )
-            log = _LOGGER.debug if bulk else _LOGGER.warning
-            log("Not decoded %s (no addr2line or ELF)", addr)
-            return
-        addr2line, elf = idedata.addr2line_path, idedata.firmware_elf_path
-    command = [addr2line, "-pfiaC", "-e", elf, addr]
+    idedata = toolchain.get_idedata(config)
+    if not idedata.addr2line_path or not idedata.firmware_elf_path:
+        _LOGGER.debug("decode_pc no addr2line")
+        return
+    command = [idedata.addr2line_path, "-pfiaC", "-e", idedata.firmware_elf_path, addr]
     try:
         translation = subprocess.check_output(command, close_fds=False).decode().strip()
-    except Exception as err:  # noqa: BLE001  # pylint: disable=broad-except
-        # Warn, not debug: a failing addr2line must be visible. The warning
-        # is rate-limited across a dump, so mark every undecoded address
-        # inline or the rest read as merely unmappable
-        if not _warn_decode_problem(
-            "addr2line-failed", "Could not decode crash address %s (%s)", addr, err
-        ):
-            # The detailed warning already named this address; mark only
-            # the rate-limited ones, and bulk stack words at debug
-            log = _LOGGER.debug if bulk else _LOGGER.warning
-            log("Not decoded %s (addr2line failed)", addr)
+    except Exception:  # noqa: BLE001  # pylint: disable=broad-except
         _LOGGER.debug("Caught exception for command %s", command, exc_info=1)
         return
 
     if "?? ??:0" in translation:
-        # A named register that fails to decode is confusing silence; a
-        # bulk stack word failing is the expected common case
-        log = _LOGGER.debug if bulk else _LOGGER.warning
-        log("Not decoded %s (address not in %s)", addr, elf)
+        # Nothing useful
         return
     translation = translation.replace(" at ??:?", "").replace(":?", "")
     _LOGGER.warning("Decoded %s", translation)
@@ -746,6 +596,6 @@ def process_stacktrace(config: ConfigType, line: str, backtrace_state: bool) ->
 
     if backtrace_state:
         for addr in re.finditer(STACKTRACE_ESP8266_BACKTRACE_PC_RE, line):
-            _decode_pc(config, addr.group(), bulk=True)
+            _decode_pc(config, addr.group())
 
     return backtrace_state

esphome/components/esp8266/const.py

@@ -16,6 +16,7 @@ KEY_WAVEFORM_REQUIRED = "waveform_required"
 KEY_SERIAL_REQUIRED = "serial_required"
 KEY_SERIAL1_REQUIRED = "serial1_required"
 # Set for the native (non-PlatformIO) toolchain's build generator
+KEY_FLASH_MODE = "flash_mode"
 KEY_SCANF_FLOAT = "scanf_float"
 # Per-board flash-layout override consumed by board_ld_script()
 KEY_LDSCRIPT = "ldscript"
@@ -72,6 +73,3 @@ def enable_serial1() -> None:
             enable_serial1()
     """
     CORE.data.setdefault(KEY_ESP8266, {})[KEY_SERIAL1_REQUIRED] = True
-
-
-BUILD_FLASH_MODES = ("qio", "qout", "dio", "dout")

esphome/components/esphome/ota/__init__.py

@@ -2,12 +2,12 @@ import logging
 
 import esphome.codegen as cg
 from esphome.components.noise import (
-    decode_encryption_key,
     encryption_schema,
-    is_reserved_key,
+    new_psk_progmem,
+    static_encryption_key,
 )
 from esphome.components.ota import BASE_OTA_SCHEMA, OTAComponent, ota_to_code
-from esphome.config_helpers import merge_config
+from esphome.config_helpers import filter_source_files_from_defines, merge_config
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_API,
@@ -31,7 +31,6 @@ import esphome.final_validate as fv
 from esphome.types import ConfigType
 
 CONF_ALLOW_PARTITION_ACCESS = "allow_partition_access"
-CONF_CAPTIVE_PORTAL = "captive_portal"
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -41,11 +40,10 @@ DEPENDENCIES = ["network"]
 
 
 def AUTO_LOAD(config: ConfigType) -> list[str]:
-    """Auto-load noise only when encryption is configured."""
+    """Auto-load noise only when encryption is configured; the api key offer
+    inherits it from the api component."""
     base = ["sha256", "socket"]
-    # A falsy config is a tooling probe for the maximal set (None from
-    # dependency resolution, {} from the components-graph platform probe);
-    # a validated config always carries defaults, never empty
+    # A falsy config is a tooling probe for the maximal set
     if not config or CONF_ENCRYPTION in config:
         return base + ["noise"]
     return base
@@ -132,12 +130,56 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
         _validate_no_password_with_encryption(ota_conf)
         if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
             _resolve_encryption_key(encryption_conf, api_conf)
-    if any(
-        conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf
-    ) and any(
-        CONF_ENCRYPTION in conf for conf in merged_ota_esphome_configs_by_port.values()
+        elif CONF_PASSWORD in ota_conf and static_encryption_key(api_conf) is not None:
+            _LOGGER.warning(
+                "'%s' %s wastes significant flash and RAM (about 3.5 KB and 60 "
+                "bytes plus the password on the heap): the device already offers "
+                "encryption with the '%s' %s %s, which authenticates any uploader "
+                "that takes it, and a password only matters for uploaders without "
+                "encryption support; remove '%s' and add '%s' under '%s' so "
+                "uploads use the key and encryption is required",
+                CONF_OTA,
+                CONF_PASSWORD,
+                CONF_API,
+                CONF_ENCRYPTION,
+                CONF_KEY,
+                CONF_PASSWORD,
+                CONF_ENCRYPTION,
+                CONF_OTA,
+            )
+        elif (
+            CONF_PASSWORD in ota_conf
+            and CONF_ENCRYPTION in api_conf
+            and not api_conf[CONF_ENCRYPTION].get(CONF_KEY)
+        ):
+            # The CLI still needs the password; whoever provisions the key skips it
+            _LOGGER.warning(
+                "The '%s' %s %s provisioned at runtime also authenticates OTA "
+                "uploads once provisioned; '%s' %s then only guards plaintext "
+                "uploads. Whoever provisions the key can upload firmware "
+                "without the password, so add a 'provisioning:' block to limit "
+                "when that is possible",
+                CONF_API,
+                CONF_ENCRYPTION,
+                CONF_KEY,
+                CONF_OTA,
+                CONF_PASSWORD,
+            )
+    # web_server and prometheus keep the shared listener up; the captive
+    # portal's copy only exists on the fallback AP and is the recovery path
+    if (
+        (CONF_WEB_SERVER in full_conf or "prometheus" in full_conf)
+        and any(conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf)
+        and any(
+            CONF_ENCRYPTION in conf
+            for conf in merged_ota_esphome_configs_by_port.values()
+        )
     ):
-        _warn_web_server_ota(full_conf)
+        _LOGGER.warning(
+            "OTA encryption does not cover the %s OTA platform; its "
+            "plaintext /update endpoint accepts the same image",
+            CONF_WEB_SERVER,
+        )
 
     full_conf[CONF_OTA] = new_ota_conf
     fv.full_config.set(full_conf)
@@ -152,33 +194,11 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
         )
 
 
-def _warn_web_server_ota(full_conf: ConfigType) -> None:
-    """The web_server ota platform accepts the same image over plaintext HTTP
-    with basic auth, bypassing the encryption; warn rather than fail so the
-    operator keeps the recovery path."""
-    if CONF_CAPTIVE_PORTAL in full_conf and CONF_WEB_SERVER not in full_conf:
-        # The captive_portal auto-load: the endpoint only exists while the
-        # fallback AP is active
-        _LOGGER.warning(
-            "OTA encryption does not cover the %s OTA platform (auto-loaded "
-            "by captive_portal); the plaintext /update endpoint stays "
-            "reachable while the fallback AP is active",
-            CONF_WEB_SERVER,
-        )
-    else:
-        _LOGGER.warning(
-            "OTA encryption does not cover the %s OTA platform; its "
-            "plaintext /update endpoint accepts the same image",
-            CONF_WEB_SERVER,
-        )
-
-
 def _resolve_encryption_key(encryption_conf: ConfigType, api_conf: ConfigType) -> None:
     """Resolve the one encryption key per device into the ota block.
 
     An explicit ota key must match the api key, a bare block inherits it,
-    a runtime provisioned api key cannot be inherited, and the all-zeros
-    provisioning sentinel is rejected (the device treats it as no key).
+    a runtime provisioned api key cannot be inherited.
     """
     api_key = api_conf.get(CONF_ENCRYPTION, {}).get(CONF_KEY)
     if ota_key := encryption_conf.get(CONF_KEY):
@@ -201,11 +221,6 @@ def _resolve_encryption_key(encryption_conf: ConfigType, api_conf: ConfigType) -
         )
     else:
         encryption_conf[CONF_KEY] = api_key
-    if is_reserved_key(encryption_conf[CONF_KEY]):
-        raise cv.Invalid(
-            f"The all-zeros {CONF_KEY} is reserved and provides no protection; "
-            f"generate a real key with: openssl rand -base64 32"
-        )
 
 
 # Also called on merged same-port configs in final validate, where schemas
@@ -267,15 +282,9 @@ CONFIG_SCHEMA = cv.All(
 FINAL_VALIDATE_SCHEMA = ota_esphome_final_validate
 
 
-def FILTER_SOURCE_FILES() -> list[str]:
-    """Filter out the noise transport when no ota entry configures encryption."""
-    for ota_conf in CORE.config.get(CONF_OTA, []):
-        if (
-            ota_conf.get(CONF_PLATFORM) == CONF_ESPHOME
-            and ota_conf.get(CONF_ENCRYPTION) is not None
-        ):
-            return []
-    return ["ota_esphome_noise.cpp"]
+FILTER_SOURCE_FILES = filter_source_files_from_defines(
+    {"ota_esphome_noise.cpp": "USE_OTA_ENCRYPTION"}
+)
 
 
 @coroutine_with_priority(CoroPriority.OTA_UPDATES)
@@ -296,11 +305,24 @@ async def to_code(config: ConfigType) -> None:
     if config.get(CONF_ALLOW_PARTITION_ACCESS):
         cg.add_define("USE_OTA_PARTITIONS")
 
-    if (encryption_conf := config.get(CONF_ENCRYPTION)) is not None:
-        # A missing key was resolved from the api component in final validate.
-        key = encryption_conf[CONF_KEY]
+    # One key per device: an api encryption block supplies it (static or
+    # runtime) and offers; the ota block only adds the requirement
+    api_conf = CORE.config.get(CONF_API) or {}
+    encryption_conf = config.get(CONF_ENCRYPTION)
+    own_key = None
+    if encryption_conf is not None and static_encryption_key(api_conf) is None:
+        own_key = encryption_conf[CONF_KEY]
+    if own_key is not None:
         cg.add_define("USE_OTA_ENCRYPTION")
-        cg.add(var.set_noise_psk(list(decode_encryption_key(key))))
+        cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], own_key)))
+    elif CONF_ENCRYPTION in api_conf:
+        cg.add_define("USE_OTA_ENCRYPTION")
+        cg.add_define("USE_OTA_ENCRYPTION_FROM_API")
+        if static_encryption_key(api_conf) is None:
+            # The key arrives at runtime, so the offer has to look for it
+            cg.add_define("USE_OTA_ENCRYPTION_PROVISIONED")
+    if encryption_conf is not None:
+        cg.add_define("USE_OTA_ENCRYPTION_REQUIRED")
 
     # Build flag so lwip_fast_select.c (a .c file that can't include defines.h) sees it.
     cg.add_build_flag("-DUSE_OTA_PLATFORM_ESPHOME")

esphome/components/esphome/ota/ota_esphome.cpp

@@ -1,4 +1,7 @@
 #include "ota_esphome.h"
+#ifdef USE_OTA_ENCRYPTION_FROM_API
+#include "esphome/components/api/api_server.h"
+#endif
 #ifdef USE_OTA
 #ifdef USE_OTA_PASSWORD
 #include "esphome/components/sha256/sha256.h"
@@ -26,6 +29,16 @@
 namespace esphome {
 
 static const char *const TAG = "esphome.ota";
+
+#ifdef USE_OTA_ENCRYPTION
+const noise::NoiseContext &ESPHomeOTAComponent::noise_context_() const {
+#ifdef USE_OTA_ENCRYPTION_FROM_API
+  return api::global_api_server->get_noise_ctx();
+#else
+  return this->noise_ctx_;
+#endif
+}
+#endif
 static constexpr uint16_t OTA_BLOCK_SIZE = 8192;
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_HANDSHAKE = 20000;  // milliseconds for initial handshake
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 90000;       // milliseconds for data transfer
@@ -97,18 +110,30 @@ void ESPHomeOTAComponent::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "Over-The-Air updates:\n"
                 "  Address: %s:%u\n"
-                "  Version: %d",
-                network::get_use_address_to(addr_buf), this->port_, USE_OTA_VERSION);
+                "  Version: %d"
+#ifdef USE_OTA_ENCRYPTION
+                "\n  Encryption: %s"
+#endif
+                ,
+                network::get_use_address_to(addr_buf), this->port_, USE_OTA_VERSION
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+                ,
+                LOG_STR_LITERAL("required")
+#elif defined(USE_OTA_ENCRYPTION_PROVISIONED)
+                // A runtime provisioned key may not exist yet
+                ,
+                this->noise_context_().has_psk() ? LOG_STR_LITERAL("offered, plaintext accepted")
+                                                 : LOG_STR_LITERAL("offered once the api key is provisioned")
+#elif defined(USE_OTA_ENCRYPTION)
+                ,
+                LOG_STR_LITERAL("offered, plaintext accepted")
+#endif
+  );
 #ifdef USE_OTA_PASSWORD
   if (!this->password_.empty()) {
     ESP_LOGCONFIG(TAG, "  Password configured");
   }
 #endif
-#ifdef USE_OTA_ENCRYPTION
-  if (this->noise_ctx_.has_psk()) {
-    ESP_LOGCONFIG(TAG, "  Encryption configured");
-  }
-#endif
 #ifdef USE_OTA_PARTITIONS
   ESP_LOGCONFIG(TAG,
                 "  Partition access allowed\n"
@@ -154,10 +179,22 @@ static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_NOISE = 0x08;
+// Noise needs the extended protocol: the prologue binds the 2-byte feature ack
+static constexpr uint8_t CLIENT_NOISE_FEATURES =
+    CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_NOISE = 0x04;
 
+inline bool ESPHomeOTAComponent::extended_proto_() const {
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+  // FEATURE_READ already refused every client without the extended protocol
+  return true;
+#else
+  return (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL) != 0;
+#endif
+}
+
 void ESPHomeOTAComponent::handle_handshake_() {
   /// Handle the OTA handshake and authentication.
   ///
@@ -241,12 +278,9 @@ void ESPHomeOTAComponent::handle_handshake_() {
       this->ota_features_ = this->handshake_buf_[0];
       ESP_LOGV(TAG, "Features: 0x%02X", this->ota_features_);
 
-#ifdef USE_OTA_ENCRYPTION
-      // Fail closed: with a PSK configured the client must negotiate encryption
-      // (which requires the extended protocol); refuse plaintext uploads.
-      static constexpr uint8_t NOISE_REQUIRED_FEATURES =
-          CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
-      if (this->noise_ctx_.has_psk() && (this->ota_features_ & NOISE_REQUIRED_FEATURES) != NOISE_REQUIRED_FEATURES) {
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+      // `ota: encryption:` requires the client to negotiate encryption
+      if ((this->ota_features_ & CLIENT_NOISE_FEATURES) != CLIENT_NOISE_FEATURES) {
         ESP_LOGW(TAG, "Client does not support encryption");
         this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_ENCRYPTION_REQUIRED);
         return;
@@ -261,18 +295,21 @@ void ESPHomeOTAComponent::handle_handshake_() {
       // Compose the feature-ack response. When the client negotiates the extended protocol we emit
       // a 2-byte response (marker + server feature flags); otherwise we emit the single-byte
       // legacy response.
-      this->extended_proto_ = (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL) != 0;
-      if (this->extended_proto_) {
+      if (this->extended_proto_()) {
         static_assert(HANDSHAKE_BUF_SIZE >= 2, "handshake_buf_ must hold the 2-byte extended-protocol feature ack");
         this->handshake_buf_[0] = ota::OTA_RESPONSE_FEATURE_FLAGS;
         this->handshake_buf_[1] = (supports_compression ? SERVER_FEATURE_SUPPORTS_COMPRESSION : 0);
 #ifdef USE_OTA_PARTITIONS
         this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS;
 #endif
-#ifdef USE_OTA_ENCRYPTION
-        if (this->noise_ctx_.has_psk()) {
+#ifdef USE_OTA_ENCRYPTION_PROVISIONED
+        // A runtime provisioned key may not exist yet
+        if (this->noise_context_().has_psk()) {
           this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
         }
+#elif defined(USE_OTA_ENCRYPTION)
+        // A yaml key always exists: validation rejects the all-zeros key
+        this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
 #endif
       } else {
         this->handshake_buf_[0] =
@@ -284,15 +321,15 @@ void ESPHomeOTAComponent::handle_handshake_() {
     case OTAState::FEATURE_ACK: {
       static constexpr size_t STANDARD_PROTO_ACK_SIZE = 1;
       static constexpr size_t EXTENDED_PROTO_ACK_SIZE = 2;
-      const size_t ack_size = this->extended_proto_ ? EXTENDED_PROTO_ACK_SIZE : STANDARD_PROTO_ACK_SIZE;
+      const size_t ack_size = this->extended_proto_() ? EXTENDED_PROTO_ACK_SIZE : STANDARD_PROTO_ACK_SIZE;
       if (!this->try_write_(ack_size, LOG_STR("ack feature"))) {
         return;
       }
 #ifdef USE_OTA_ENCRYPTION
-      // With a PSK configured the rest of the session runs inside the noise
-      // transport; the client sends the first handshake frame next, so there
-      // is nothing to do until data arrives.
-      if (this->noise_ctx_.has_psk()) {
+      // Latch the offer actually sent: a key activating between the two
+      // states must not start a session the client never expects
+      if ((this->handshake_buf_[1] & SERVER_FEATURE_SUPPORTS_NOISE) != 0 &&
+          (this->ota_features_ & CLIENT_NOISE_FEATURES) == CLIENT_NOISE_FEATURES) {
         // handshake_buf_ still holds the feature ack composed above; a
         // would-block re-entry lands here without rebuilding it
         if (!this->noise_start_session_(this->handshake_buf_[1])) {
@@ -412,7 +449,7 @@ void ESPHomeOTAComponent::handle_data_() {
   // Acknowledge auth OK - 1 byte
   this->data_write_byte_(ota::OTA_RESPONSE_AUTH_OK);
 
-  if (this->extended_proto_) {
+  if (this->extended_proto_()) {
     // Read ota type, 1 byte
     if (!this->data_readall_(buf, 1)) {
       this->log_read_error_(LOG_STR("OTA type"));

esphome/components/esphome/ota/ota_esphome.h

@@ -44,8 +44,9 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   }
 #endif  // USE_OTA_PASSWORD
 
-#ifdef USE_OTA_ENCRYPTION
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
+#if defined(USE_OTA_ENCRYPTION) && !defined(USE_OTA_ENCRYPTION_FROM_API)
+  /// psk points at 32 bytes that live in flash for the life of the program
+  void set_noise_psk(const uint8_t *psk) { this->noise_ctx_.set_psk(psk); }
 #endif
 
   /// Manually set the port OTA should listen on
@@ -85,9 +86,12 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
     bool writing{false};    // a produced handshake frame is still being flushed
     uint8_t frame_buf[noise::FRAME_HEADER_SIZE + 1 + noise::MAX_HANDSHAKE_SIZE];
   };
+  // The api server's live context when the api has encryption, else our own
+  const noise::NoiseContext &noise_context_() const;
   bool noise_start_session_(uint8_t server_feature_flags);
   bool handle_noise_handshake_();
   bool noise_try_read_frame_();
+  size_t noise_frame_payload_len_(const uint8_t *header, size_t min_len, size_t max_len);
   bool noise_try_write_frame_();
   void noise_send_reject_(const LogString *reason);
   ssize_t noise_decrypt_(uint8_t *buf, size_t len);
@@ -144,7 +148,9 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   std::unique_ptr<uint8_t[]> auth_buf_;
 #endif  // USE_OTA_PASSWORD
 #ifdef USE_OTA_ENCRYPTION
+#ifndef USE_OTA_ENCRYPTION_FROM_API
   noise::NoiseContext noise_ctx_;
+#endif
   std::unique_ptr<NoiseSession> noise_;
 #endif  // USE_OTA_ENCRYPTION
 
@@ -166,6 +172,8 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
                 "OTA_BUFFER_SIZE must fit a full encrypted data frame");
 #endif
   static constexpr uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
+  // Derived from the feature byte; storing it would pad the trailing bytes
+  bool extended_proto_() const;
 #ifdef USE_OTA_PARTITIONS
   uint32_t running_app_offset_{0};
   size_t running_app_size_{0};
@@ -179,7 +187,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   uint8_t auth_buf_pos_{0};
   uint8_t auth_type_{0};  // Store auth type to know which hasher to use
 #endif                    // USE_OTA_PASSWORD
-  bool extended_proto_{false};
 };
 
 }  // namespace esphome

esphome/components/esphome/ota/ota_esphome_noise.cpp

@@ -3,6 +3,7 @@
 #ifdef USE_OTA_ENCRYPTION
 #include "esphome/components/noise/noise.h"
 #include "esphome/components/ota/ota_backend.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
 #include <cstring>
@@ -40,24 +41,17 @@ ESPHomeOTAComponent::NoiseSession::~NoiseSession() {
  *   "NoiseOTAInit" | magic(5) | OK,version | client_features | FEATURE_FLAGS,server_flags
  */
 bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
+  // A provisioned key cleared between the offer and here is not guarded: the
+  // session runs on the zero key load_psk fills in and fails the client's MAC.
+  // Default-init: the frame buffer is written before it is read
   // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
-  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession());
-  if (this->noise_ == nullptr) {
-    ESP_LOGW(TAG, "Session allocation failed");
-    this->cleanup_connection_();
-    return false;
-  }
-
+  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession);
   static constexpr size_t PROLOGUE_ACK_LEN = 2;  // OTA_RESPONSE_OK + version
   static constexpr size_t PROLOGUE_CLIENT_FEATURES_LEN = 1;
   static constexpr size_t PROLOGUE_FEATURE_ACK_LEN = 2;  // OTA_RESPONSE_FEATURE_FLAGS + server flags
   uint8_t prologue[OTA_NOISE_PROLOGUE_INIT_LEN + sizeof(MAGIC_BYTES) + PROLOGUE_ACK_LEN + PROLOGUE_CLIENT_FEATURES_LEN +
                    PROLOGUE_FEATURE_ACK_LEN];
-#ifdef USE_ESP8266
-  memcpy_P(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#else
-  std::memcpy(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#endif
+  progmem_memcpy(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
   uint8_t *p = prologue + OTA_NOISE_PROLOGUE_INIT_LEN;
   // Magic bytes, already validated in MAGIC_READ
   std::memcpy(p, MAGIC_BYTES, sizeof(MAGIC_BYTES));
@@ -71,9 +65,13 @@ bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
   *p++ = ota::OTA_RESPONSE_FEATURE_FLAGS;
   *p++ = server_feature_flags;
 
-  int err = this->noise_->handshake.init(this->noise_ctx_.get_psk(), prologue, sizeof(prologue));
+  // The caller only starts a session when the context holds a key
+  int err = this->noise_ == nullptr ? NOISE_ERROR_NO_MEMORY
+                                    : this->noise_->handshake.init(this->noise_context_(), prologue, sizeof(prologue));
   if (err != 0) {
-    ESP_LOGW(TAG, "Handshake init: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    // Raw noise codes throughout: the name table would cost flash in builds
+    // where only the OTA uses noise
+    ESP_LOGW(TAG, "Session init: %d", err);
     this->cleanup_connection_();
     return false;
   }
@@ -105,14 +103,16 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
         s.frame_pos = 0;
         s.frame_len = 0;
         if (s.frame_buf[noise::FRAME_HEADER_SIZE] != noise::HANDSHAKE_STATUS_OK) {
-          ESP_LOGW(TAG, "Bad handshake error byte: %u", s.frame_buf[noise::FRAME_HEADER_SIZE]);
+          ESP_LOGW(TAG, "Client rejected the handshake: %u", s.frame_buf[noise::FRAME_HEADER_SIZE]);
           this->cleanup_connection_();
           return false;
         }
         int err = s.handshake.read_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, payload_len - 1);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake read: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-          this->noise_send_reject_(noise::reject_reason_for(err));
+          // A MAC failure here almost always means the uploader has a different key
+          const LogString *reason = noise::reject_reason_for(err);
+          ESP_LOGW(TAG, "Handshake read: %s (%d)", LOG_STR_ARG(reason), err);
+          this->noise_send_reject_(reason);
           this->cleanup_connection_();
           return false;
         }
@@ -123,7 +123,7 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
         int err =
             s.handshake.write_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, noise::MAX_HANDSHAKE_SIZE, msg_len);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake write: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+          ESP_LOGW(TAG, "Handshake write: %d", err);
           this->cleanup_connection_();
           return false;
         }
@@ -138,7 +138,7 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
       case noise::NoiseResponderHandshake::Action::ACTION_SPLIT: {
         int err = s.handshake.split(s.send_cipher, s.recv_cipher);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake split: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+          ESP_LOGW(TAG, "Handshake split: %d", err);
           this->cleanup_connection_();
           return false;
         }
@@ -154,33 +154,41 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
   }
 }
 
+/// Payload length from a frame header, or 0 (logged) when the indicator or
+/// the length is out of range. Callers pass min_len >= 1 so 0 is never valid.
+size_t ESPHomeOTAComponent::noise_frame_payload_len_(const uint8_t *header, size_t min_len, size_t max_len) {
+  const size_t payload_len = encode_uint16(header[1], header[2]);
+  if (header[0] != noise::FRAME_INDICATOR || payload_len < min_len || payload_len > max_len) {
+    ESP_LOGW(TAG, "Bad frame: 0x%02X, %zu bytes", header[0], payload_len);
+    return 0;
+  }
+  return payload_len;
+}
+
 /// Non-blocking read of one handshake frame into the session buffer.
 bool ESPHomeOTAComponent::noise_try_read_frame_() {
   NoiseSession &s = *this->noise_;
-  while (s.frame_pos < noise::FRAME_HEADER_SIZE) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, noise::FRAME_HEADER_SIZE - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise header"))) {
-      return false;
+  while (true) {
+    // The header first, then the body once the header says how long it is
+    const uint16_t want = s.frame_len == 0 ? noise::FRAME_HEADER_SIZE : s.frame_len;
+    if (s.frame_pos < want) {
+      ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, want - s.frame_pos);
+      if (!this->handle_read_error_(read, LOG_STR("read noise"))) {
+        return false;
+      }
+      s.frame_pos += read;
+      continue;
     }
-    s.frame_pos += read;
-  }
-  if (s.frame_len == 0) {
-    const uint16_t payload_len = encode_uint16(s.frame_buf[1], s.frame_buf[2]);
-    if (s.frame_buf[0] != noise::FRAME_INDICATOR || payload_len < 1 || payload_len > 1 + noise::MAX_HANDSHAKE_SIZE) {
-      ESP_LOGW(TAG, "Bad handshake frame: 0x%02X, %u bytes", s.frame_buf[0], payload_len);
+    if (s.frame_len != 0) {
+      return true;
+    }
+    const size_t payload_len = this->noise_frame_payload_len_(s.frame_buf, 1, 1 + noise::MAX_HANDSHAKE_SIZE);
+    if (payload_len == 0) {
       this->cleanup_connection_();
       return false;
     }
     s.frame_len = noise::FRAME_HEADER_SIZE + payload_len;
   }
-  while (s.frame_pos < s.frame_len) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, s.frame_len - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise frame"))) {
-      return false;
-    }
-    s.frame_pos += read;
-  }
-  return true;
 }
 
 /// Non-blocking write of the pending session-buffer frame.
@@ -214,7 +222,7 @@ ssize_t ESPHomeOTAComponent::noise_decrypt_(uint8_t *buf, size_t len) {
   noise_buffer_set_inout(mbuf, buf, len, len);
   int err = noise_cipherstate_decrypt(this->noise_->recv_cipher, &mbuf);
   if (err != 0) {
-    ESP_LOGW(TAG, "Decrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    ESP_LOGW(TAG, "Decrypt: %d", err);
     return -1;
   }
   return mbuf.size;
@@ -229,9 +237,8 @@ ssize_t ESPHomeOTAComponent::noise_read_frame_blocking_(uint8_t *buf, size_t min
   if (!this->readall_(header, sizeof(header))) {
     return -1;
   }
-  const size_t ciphertext_len = encode_uint16(header[1], header[2]);
-  if (header[0] != noise::FRAME_INDICATOR || ciphertext_len < min_ciphertext || ciphertext_len > max_ciphertext) {
-    ESP_LOGW(TAG, "Bad frame: 0x%02X, %zu bytes", header[0], ciphertext_len);
+  const size_t ciphertext_len = this->noise_frame_payload_len_(header, min_ciphertext, max_ciphertext);
+  if (ciphertext_len == 0) {
     return -1;
   }
   if (!this->readall_(buf, ciphertext_len)) {
@@ -267,7 +274,7 @@ bool ESPHomeOTAComponent::noise_write_byte_(uint8_t byte) {
   noise_buffer_set_inout(mbuf, frame + noise::FRAME_HEADER_SIZE, 1, 1 + noise::MAC_SIZE);
   int err = noise_cipherstate_encrypt(this->noise_->send_cipher, &mbuf);
   if (err != 0) {
-    ESP_LOGW(TAG, "Encrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    ESP_LOGW(TAG, "Encrypt: %d", err);
     return false;
   }
   noise::write_frame_header(frame, mbuf.size);

esphome/components/host/__init__.py

@@ -1,4 +1,3 @@
-from esphome.build_helpers.pch import pch_enabled, pch_extra_scripts
 import esphome.codegen as cg
 import esphome.config_validation as cv
 from esphome.const import (
@@ -11,7 +10,7 @@ from esphome.const import (
     ThreadModel,
 )
 from esphome.core import CORE
-from esphome.platformio.toolchain import copy_ccache_script, copy_pch_script
+from esphome.platformio.toolchain import copy_ccache_script
 from esphome.types import ConfigType
 
 from .const import KEY_HOST
@@ -19,9 +18,6 @@ from .const import KEY_HOST
 # force import gpio to register pin schema
 from .gpio import host_pin_to_code  # noqa: F401
 
-# Guarded wrapper: build_src_flags reaches C/assembly edges too
-HOST_PCH_PREFIX = "esphome/core/pch_prefix.h"
-
 CODEOWNERS = ["@esphome/core", "@clydebarrow"]
 AUTO_LOAD = ["network", "preferences"]
 IS_TARGET_PLATFORM = True
@@ -59,18 +55,9 @@ async def to_code(config: ConfigType) -> None:
     cg.add_platformio_option("platform", "platformio/native")
     cg.add_platformio_option("lib_ldf_mode", "off")
     cg.add_platformio_option("lib_compat_mode", "strict")
-    cg.add_platformio_option("extra_scripts", ["pre:ccache.py", *pch_extra_scripts()])
-    if pch_enabled():
-        # Curated prefix for the pch (the script folds it plus defines.h):
-        # host has no framework force-includes, and the per-TU cost is the
-        # STL closure behind the core headers. Measured -43% compile CPU.
-        # Gated so ESPHOME_PCH_ENABLE=0 restores the strict view. When the
-        # .gch fails to build or load, the force-include stays and every TU
-        # parses the closure as text: correct, but slower than no pch.
-        cg.add_platformio_option("build_src_flags", f"-include {HOST_PCH_PREFIX}")
+    cg.add_platformio_option("extra_scripts", ["pre:ccache.py"])
 
 
 # Called by writer.py
 def copy_files() -> None:
     copy_ccache_script()
-    copy_pch_script()

esphome/components/libretiny/__init__.py

@@ -2,7 +2,6 @@ import json
 import logging
 from pathlib import Path
 
-from esphome.build_helpers.pch import pch_extra_scripts
 import esphome.codegen as cg
 import esphome.config_validation as cv
 from esphome.const import (
@@ -27,7 +26,7 @@ from esphome.const import (
 from esphome.core import CORE
 from esphome.core.config import BOARD_MAX_LENGTH
 from esphome.helpers import copy_file_if_changed
-from esphome.platformio.toolchain import copy_ccache_script, copy_pch_script
+from esphome.platformio.toolchain import copy_ccache_script
 from esphome.storage_json import StorageJSON
 
 from . import gpio  # noqa: F401
@@ -514,7 +513,7 @@ async def component_to_code(config):
         # it for project source files only. GCC uses the last -O flag.
         build_src_flags += " -Os"
     cg.add_platformio_option("build_src_flags", build_src_flags)
-    cg.add_platformio_option("extra_scripts", ["pre:ccache.py", *pch_extra_scripts()])
+    cg.add_platformio_option("extra_scripts", ["pre:ccache.py"])
     # IRAM_ATTR is a no-op on BK72xx (SDK masks FIQ+IRQ around flash ops).
     # On other families, patch_linker.py routes .sram.text into the right
     # RAM-executable output section and prints a post-link placement summary.
@@ -620,4 +619,3 @@ def copy_files() -> None:
         CORE.relative_build_path("patch_linker.py"),
     )
     copy_ccache_script()
-    copy_pch_script()

esphome/components/noise/__init__.py

@@ -4,7 +4,9 @@ from typing import Any
 
 import esphome.codegen as cg
 import esphome.config_validation as cv
-from esphome.const import CONF_KEY
+from esphome.const import CONF_ENCRYPTION, CONF_KEY
+from esphome.core import ID
+from esphome.cpp_generator import MockObj
 from esphome.types import ConfigType
 
 CODEOWNERS = ["@esphome/core"]
@@ -23,6 +25,14 @@ def validate_encryption_key(value: Any) -> str:
 
     if len(decoded) != 32:
         raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
+    if not any(decoded):
+        # The device treats the all-zeros key as no key at all (it is the
+        # provisioning sentinel), so it must never reach a build
+        raise cv.Invalid(
+            f"The all-zeros {CONF_KEY} is reserved and provides no protection; "
+            f"omit the {CONF_KEY} to provision it at runtime, or generate a real "
+            "key with: openssl rand -base64 32"
+        )
 
     # Return original data for roundtrip conversion
     return value
@@ -45,15 +55,6 @@ def decode_encryption_key(value: str) -> bytes:
     return decoded
 
 
-def is_reserved_key(value: str) -> bool:
-    """Whether the key is the reserved all-zeros provisioning sentinel.
-
-    The device treats it as no key configured, so consumers that require a
-    real key must reject it.
-    """
-    return not any(decode_encryption_key(value))
-
-
 ENCRYPTION_SCHEMA = cv.Schema(
     {
         cv.Optional(CONF_KEY): cv.sensitive(validate_encryption_key),
@@ -61,6 +62,21 @@ ENCRYPTION_SCHEMA = cv.Schema(
 )
 
 
+def static_encryption_key(conf: ConfigType) -> str | None:
+    """The build time key of a component config; None without one or when
+    the key is provisioned at runtime."""
+    return (conf.get(CONF_ENCRYPTION) or {}).get(CONF_KEY) or None
+
+
+def new_psk_progmem(parent_id: ID, key: str) -> MockObj:
+    """Emit the decoded key as a PROGMEM array; the component keeps a pointer
+    so the key never occupies RAM."""
+    return cg.progmem_array(
+        ID(f"{parent_id.id}_psk", is_declaration=True, type=cg.uint8),
+        list(decode_encryption_key(key)),
+    )
+
+
 def encryption_schema(config: ConfigType | None) -> ConfigType:
     # A bare `encryption:` block is valid; a missing key means the consumer
     # falls back to its keyless behavior (api provisioning, ota inheriting

esphome/components/noise/noise.cpp

@@ -1,5 +1,6 @@
 #include "noise.h"
 #ifdef USE_NOISE
+#include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
 #include <algorithm>
@@ -15,6 +16,14 @@ namespace esphome::noise {
 
 static const char *const TAG = "noise";
 
+void NoiseContext::load_psk(psk_t &out) const {
+  if (this->psk_ == nullptr) {
+    out.fill(0);
+    return;
+  }
+  progmem_memcpy(out.data(), this->psk_, out.size());
+}
+
 const LogString *noise_err_to_logstr(int err) {
   if (err == NOISE_ERROR_NO_MEMORY)
     return LOG_STR("NO_MEMORY");

esphome/components/noise/noise.h

@@ -23,16 +23,16 @@ class NoiseContext {
     }
     return acc == 0;
   }
-  void set_psk(psk_t psk) {
-    this->psk_ = psk;
-    this->has_psk_ = !is_all_zeros(psk);
-  }
-  const psk_t &get_psk() const { return this->psk_; }
-  bool has_psk() const { return this->has_psk_; }
+  /// psk points at 32 bytes that outlive the context (PROGMEM or caller owned
+  /// RAM); nullptr means no key. Runtime callers map the all-zeros key to
+  /// nullptr themselves; validation keeps it out of yaml.
+  void set_psk(const uint8_t *psk) { this->psk_ = psk; }
+  /// Copy the key out (flash-aware on ESP8266); all zeros when none is set.
+  void load_psk(psk_t &out) const;
+  bool has_psk() const { return this->psk_ != nullptr; }
 
  protected:
-  psk_t psk_{};
-  bool has_psk_{false};
+  const uint8_t *psk_{nullptr};
 };
 
 /// Convert a noise error code to a readable error

esphome/components/noise/noise_handshake.cpp

@@ -20,7 +20,7 @@ NoiseResponderHandshake::~NoiseResponderHandshake() {
   }
 }
 
-int NoiseResponderHandshake::init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len) {
+int NoiseResponderHandshake::init(const NoiseContext &ctx, const uint8_t *prologue, size_t prologue_len) {
   if (this->handshake_ != nullptr) {
     noise_handshakestate_free(this->handshake_);
     this->handshake_ = nullptr;
@@ -44,6 +44,9 @@ int NoiseResponderHandshake::init(const psk_t &psk, const uint8_t *prologue, siz
     HANDSHAKE_STEP_LOG("noise_handshakestate_new_by_id", err);
     return err;
   }
+  // noise-c keeps its own copy, so the key only passes through the stack here
+  psk_t psk;
+  ctx.load_psk(psk);
   err = noise_handshakestate_set_pre_shared_key(this->handshake_, psk.data(), psk.size());
   if (err != 0) {
     HANDSHAKE_STEP_LOG("noise_handshakestate_set_pre_shared_key", err);

esphome/components/noise/noise_handshake.h

@@ -36,9 +36,9 @@ class NoiseResponderHandshake {
   NoiseResponderHandshake(const NoiseResponderHandshake &) = delete;
   NoiseResponderHandshake &operator=(const NoiseResponderHandshake &) = delete;
 
-  /// Create and start the handshake with the given PSK and prologue. A
-  /// repeated call frees the previous handshake state and starts over.
-  [[nodiscard]] int init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len);
+  /// Create and start the handshake with the context's PSK and the prologue.
+  /// A repeated call frees the previous handshake state and starts over.
+  [[nodiscard]] int init(const NoiseContext &ctx, const uint8_t *prologue, size_t prologue_len);
   /// ACTION_FAILED is the catch-all: returned before init(), after split()
   /// has released the state, and when noise-c reports a failed handshake.
   [[nodiscard]] Action action() const;

esphome/components/rp2/__init__.py

@@ -6,7 +6,6 @@ from string import ascii_letters, digits
 import subprocess
 from typing import Any
 
-from esphome.build_helpers.pch import pch_extra_scripts
 import esphome.codegen as cg
 import esphome.config_validation as cv
 from esphome.const import (
@@ -34,7 +33,7 @@ from esphome.core import (
 )
 from esphome.core.config import BOARD_MAX_LENGTH
 from esphome.helpers import copy_file_if_changed, read_file, write_file_if_changed
-from esphome.platformio.toolchain import copy_ccache_script, copy_pch_script
+from esphome.platformio.toolchain import copy_ccache_script
 from esphome.storage_json import StorageJSON
 from esphome.types import ConfigType
 
@@ -341,10 +340,7 @@ async def to_code(config: ConfigType) -> None:
     cg.add_define("ESPHOME_VARIANT", VARIANT_FRIENDLY[variant])
     cg.add_define(ThreadModel.SINGLE)
 
-    cg.add_platformio_option(
-        "extra_scripts",
-        ["pre:ccache.py", *pch_extra_scripts(), "post:post_build.py"],
-    )
+    cg.add_platformio_option("extra_scripts", ["pre:ccache.py", "post:post_build.py"])
 
     conf = config[CONF_FRAMEWORK]
     cg.add_platformio_option("framework", "arduino")
@@ -648,7 +644,6 @@ def copy_files() -> None:
         CORE.relative_build_path("inject_lwip_include.py"),
     )
     copy_ccache_script()
-    copy_pch_script()
     _generate_lwipopts_h()
     if generate_pio_files():
         path = CORE.relative_src_path("esphome.h")

esphome/components/usb_uart/usb_uart.cpp

@@ -434,11 +434,12 @@ void USBUartTypeCdcAcm::on_connected() {
       auto err_comm = usb_host_interface_claim(this->handle_, this->device_handle_,
                                                channel->cdc_dev_.interrupt_interface_number, 0);
       if (err_comm != ESP_OK) {
+        // Continue anyway: the interface number stays valid for CDC request addressing
         ESP_LOGW(TAG, "Could not claim comm interface %d: %s", channel->cdc_dev_.interrupt_interface_number,
                  esp_err_to_name(err_comm));
-        channel->cdc_dev_.interrupt_interface_number = 0xFF;  // Mark as unavailable, but continue anyway
       } else {
         ESP_LOGD(TAG, "Claimed comm interface %d", channel->cdc_dev_.interrupt_interface_number);
+        channel->cdc_dev_.interrupt_interface_claimed = true;
       }
     }
     auto err =
@@ -465,14 +466,15 @@ void USBUartTypeCdcAcm::on_disconnected() {
       usb_host_endpoint_halt(this->device_handle_, channel->cdc_dev_.out_ep->bEndpointAddress);
       usb_host_endpoint_flush(this->device_handle_, channel->cdc_dev_.out_ep->bEndpointAddress);
     }
-    if (channel->cdc_dev_.notify_ep != nullptr) {
+    // Only tear down the notify pipe when we claimed its interface ourselves;
+    // no transfer is ever submitted on it, so there is nothing else to cancel.
+    if (channel->cdc_dev_.notify_ep != nullptr && channel->cdc_dev_.interrupt_interface_claimed) {
       usb_host_endpoint_halt(this->device_handle_, channel->cdc_dev_.notify_ep->bEndpointAddress);
       usb_host_endpoint_flush(this->device_handle_, channel->cdc_dev_.notify_ep->bEndpointAddress);
     }
-    if (channel->cdc_dev_.interrupt_interface_number != 0xFF &&
-        channel->cdc_dev_.interrupt_interface_number != channel->cdc_dev_.bulk_interface_number) {
+    if (channel->cdc_dev_.interrupt_interface_claimed) {
       usb_host_interface_release(this->handle_, this->device_handle_, channel->cdc_dev_.interrupt_interface_number);
-      channel->cdc_dev_.interrupt_interface_number = 0xFF;
+      channel->cdc_dev_.interrupt_interface_claimed = false;
     }
     usb_host_interface_release(this->handle_, this->device_handle_, channel->cdc_dev_.bulk_interface_number);
     // Reset the input and output started flags to their initial state to avoid the possibility of spurious restarts

esphome/components/usb_uart/usb_uart.h

@@ -34,7 +34,10 @@ struct CdcEps {
   const usb_ep_desc_t *in_ep;
   const usb_ep_desc_t *out_ep;
   uint8_t bulk_interface_number;
+  // Also the wIndex target for CDC class requests (SET_LINE_CODING etc.), so it
+  // must remain valid even when the interface itself is not claimed.
   uint8_t interrupt_interface_number;
+  bool interrupt_interface_claimed{false};
 };
 
 enum CH34xChipType : uint8_t {

esphome/components/wifi/__init__.py

@@ -66,13 +66,14 @@ from esphome.const import (
 )
 from esphome.core import (
     CORE,
+    ID,
     CoroPriority,
     EsphomeError,
     HexInt,
     coroutine_with_priority,
 )
 import esphome.final_validate as fv
-from esphome.types import ConfigType
+from esphome.types import ConfigType, TemplateArgsType
 
 from . import wpa2_eap
 
@@ -208,6 +209,7 @@ WiFiEnabledCondition = wifi_ns.class_("WiFiEnabledCondition", Condition)
 WiFiAPActiveCondition = wifi_ns.class_("WiFiAPActiveCondition", Condition)
 WiFiEnableAction = wifi_ns.class_("WiFiEnableAction", automation.Action)
 WiFiDisableAction = wifi_ns.class_("WiFiDisableAction", automation.Action)
+WiFiRoamAction = wifi_ns.class_("WiFiRoamAction", automation.Action)
 WiFiConfigureAction = wifi_ns.class_(
     "WiFiConfigureAction", automation.Action, cg.Component
 )
@@ -820,6 +822,18 @@ async def wifi_disable_to_code(config, action_id, template_arg, args):
     return cg.new_Pvariable(action_id, template_arg)
 
 
+@automation.register_action(
+    "wifi.roam", WiFiRoamAction, cv.Schema({}), synchronous=True
+)
+async def wifi_roam_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> cg.MockObj:
+    return cg.new_Pvariable(action_id, template_arg)
+
+
 KEEP_SCAN_RESULTS_KEY = "wifi_keep_scan_results"
 RUNTIME_POWER_SAVE_KEY = "wifi_runtime_power_save"
 RUNTIME_ROAMING_SUPPRESSION_KEY = "wifi_runtime_roaming_suppression"

esphome/components/wifi/automation.h

@@ -31,6 +31,11 @@ template<typename... Ts> class WiFiDisableAction final : public Action<Ts...> {
   void play(const Ts &...x) override { global_wifi_component->disable(); }
 };
 
+template<typename... Ts> class WiFiRoamAction final : public Action<Ts...> {
+ public:
+  void play(const Ts &...x) override { global_wifi_component->force_roam_check(); }
+};
+
 template<typename... Ts> class WiFiConfigureAction final : public Action<Ts...>, public Component {
  public:
   TEMPLATABLE_VALUE(std::string, ssid)

esphome/components/wifi/wifi_component.cpp

@@ -846,17 +846,18 @@ void WiFiComponent::loop() {
           this->notify_connect_state_listeners_();
 #endif
 
-          // Post-connect roaming: check for better AP
-          if (this->post_connect_roaming_) {
-            if (this->is_roaming_scan_active()) {
-              if (this->scan_done_) {
-                this->process_roaming_scan_();
-              }
-              // else: scan in progress, wait
-            } else if (this->roaming_state_ == RoamingState::IDLE && this->roaming_attempts_ < ROAMING_MAX_ATTEMPTS &&
-                       now - this->roaming_last_check_ >= ROAMING_CHECK_INTERVAL && !this->roaming_suppressed_()) {
-              this->check_roaming_(now);
+          // Post-connect roaming: check for better AP. A scan may have been started by an
+          // explicit force_roam_check() even when post_connect_roaming_ is disabled, so the
+          // scan must always be consumed here to avoid leaving roaming_state_ stuck.
+          if (this->is_roaming_scan_active()) {
+            if (this->scan_done_) {
+              this->process_roaming_scan_();
             }
+            // else: scan in progress, wait
+          } else if (this->post_connect_roaming_ && this->roaming_state_ == RoamingState::IDLE &&
+                     this->roaming_attempts_ < ROAMING_MAX_ATTEMPTS &&
+                     now - this->roaming_last_check_ >= ROAMING_CHECK_INTERVAL && !this->roaming_suppressed_()) {
+            this->check_roaming_(now);
           }
         }
         break;
@@ -2463,6 +2464,17 @@ void WiFiComponent::notify_scan_results_listeners_() {
 }
 #endif  // USE_WIFI_SCAN_RESULTS_LISTENERS
 
+void WiFiComponent::force_roam_check() {
+  if (!this->is_connected() || this->roaming_state_ != RoamingState::IDLE || this->roaming_suppressed_()) {
+    ESP_LOGD(TAG, "Roam check requested, but not able to check now");
+    return;
+  }
+  // Reset the attempt counter so a prior run of failed roams doesn't block this explicit request
+  // Note that this re-arms automatic roaming if enabled.
+  this->roaming_attempts_ = 0;
+  this->check_roaming_(millis());
+}
+
 void WiFiComponent::check_roaming_(uint32_t now) {
   // Guard: not for hidden networks (may not appear in scan)
   const WiFiAP *selected = this->get_selected_sta_();
@@ -2484,7 +2496,11 @@ void WiFiComponent::check_roaming_(uint32_t now) {
 
   ESP_LOGD(TAG, "Roam scan (%d dBm, attempt %u/%u)", rssi, this->roaming_attempts_, ROAMING_MAX_ATTEMPTS);
   this->roaming_state_ = RoamingState::SCANNING;
-  this->wifi_scan_start_(this->passive_scan_);
+  if (!this->wifi_scan_start_(this->passive_scan_)) {
+    // Scan failed to start (e.g. busy) - don't get stuck in SCANNING forever
+    ESP_LOGD(TAG, "Roam scan failed to start");
+    this->roaming_state_ = RoamingState::IDLE;
+  }
 }
 
 void WiFiComponent::process_roaming_scan_() {

esphome/components/wifi/wifi_component.h

@@ -565,6 +565,12 @@ class WiFiComponent final : public Component {
   void set_keep_scan_results(bool keep_scan_results) { this->keep_scan_results_ = keep_scan_results; }
   void set_post_connect_roaming(bool enabled) { this->post_connect_roaming_ = enabled; }
 
+  /** Force an immediate post-connect roaming check, bypassing the periodic interval and the
+   * per-connection attempt limit. Does nothing (besides a debug log) if not connected, if a
+   * roam scan or connect is already in progress, or if roaming is currently suppressed.
+   */
+  void force_roam_check();
+
 #ifdef USE_WIFI_CONNECT_TRIGGER
   Trigger<> *get_connect_trigger() { return &this->connect_trigger_; }
 #endif

esphome/core/config.py

@@ -555,14 +555,7 @@ NATIVE_ARDUINO_PIO_OPTIONS = frozenset({"board_build.f_cpu", "board_build.ldscri
 # that is stored rather than translated away. Consumed by the esp8266 native
 # backend (later in this chain) for its ignored-option warning; defined here
 # so it stays adjacent to the routing.
-# build_src_flags and board_build.flash_mode: set unconditionally by
-# esp8266/__init__ and read by the native generator; not user-routable, so
-# not in the set above
-NATIVE_ARDUINO_CONSUMED_PIO_OPTIONS = NATIVE_ARDUINO_PIO_OPTIONS | {
-    "lib_ignore",
-    "build_src_flags",
-    "board_build.flash_mode",
-}
+NATIVE_ARDUINO_CONSUMED_PIO_OPTIONS = NATIVE_ARDUINO_PIO_OPTIONS | {"lib_ignore"}
 
 
 @coroutine_with_priority(CoroPriority.FINAL)

esphome/core/defines.h

@@ -244,6 +244,9 @@
 #define USE_RUNTIME_STATS
 #define USE_OTA
 #define USE_OTA_ENCRYPTION
+#define USE_OTA_ENCRYPTION_FROM_API
+#define USE_OTA_ENCRYPTION_PROVISIONED
+#define USE_OTA_ENCRYPTION_REQUIRED
 #define USE_OTA_PASSWORD
 #define USE_OTA_VERSION 2
 #define USE_TIME_TIMEZONE

esphome/core/pch_prefix.h

@@ -1,8 +0,0 @@
-#pragma once
-// Curated precompiled-header prefix for backends that force-include it via
-// build_src_flags (the pch script folds it into the .gch). Guarded because
-// build_src_flags also reaches C and assembly src edges.
-#ifdef __cplusplus
-#include "esphome/core/application.h"
-#include "esphome/core/automation.h"
-#endif

esphome/espidf/framework.py

@@ -16,7 +16,6 @@ from esphome.build_helpers.ccache import (
     parse_enable_env,
     resolve_ccache_path,
 )
-from esphome.build_helpers.pch import ccache_pch_env
 from esphome.build_helpers.tools_cache import IDF_TOOLS_CACHE, tools_cache_path
 from esphome.core import Version
 from esphome.framework_helpers import (
@@ -1206,33 +1205,15 @@ def _ccache_env() -> dict[str, str]:
 
     Only values the user has not already set in the environment are returned, so
     a custom ``CCACHE_DIR`` / ``CCACHE_MAXSIZE`` / etc. is respected.
-    The pch settings add ``time_macros`` sloppiness process-wide; the visible
-    effect is a cached TU can keep an older ``esp_app_desc`` build timestamp.
-    """
-    if not _ccache_enabled():
-        # The raw knob value (e.g. "disable") is still inherited by idf.py
-        # via os.environ, where a non-false-constant string reads as
-        # truthy; export the canonical off spelling instead
-        return {"IDF_CCACHE_ENABLE": "0"}
-
-    env = ccache_defaults_env(get_idf_tools_path() / "ccache")
-    env.update(ccache_pch_env())
-    # Exactly one canonical spelling ever reaches idf.py, whatever the
-    # accepted input spelling was ("enable", "yes", ...)
-    env["IDF_CCACHE_ENABLE"] = "1"
-    return env
-
-
-def _ccache_enabled() -> bool:
-    """Whether ESP-IDF compiles run under ccache.
-
-    IDF_CCACHE_ENABLE (the backend-native knob) wins over the shared
-    ESPHOME_CCACHE_ENABLE; when unset, enabled iff a runnable binary is
-    on PATH.
     """
+    # IDF_CCACHE_ENABLE (the backend-native knob) wins over the shared
+    # ESPHOME_CCACHE_ENABLE.
     idf_knob = parse_enable_env("IDF_CCACHE_ENABLE")
     if idf_knob is False:
-        return False
+        # The raw value (e.g. "disable") is still inherited by idf.py via
+        # os.environ, where a non-false-constant string reads as truthy;
+        # export the canonical off spelling instead
+        return {"IDF_CCACHE_ENABLE": "0"}
     if idf_knob is True:
         # Forced on ignores the runnability verdict, but the outcome is
         # worth saying out loud. Probed directly (not via the resolver,
@@ -1252,8 +1233,17 @@ def _ccache_enabled() -> bool:
                 "IDF_CCACHE_ENABLE=1 forces on the ccache at %s even though "
                 "it failed to run; idf.py will use it anyway",
             )
-        return True
-    return resolve_ccache_path() is not None
+    elif resolve_ccache_path() is None:
+        # ESP-IDF silently skips ccache without the binary; export the
+        # canonical off spelling so an unparsable inherited value (or a
+        # probe-rejected ccache idf.py would still find) cannot enable it
+        return {"IDF_CCACHE_ENABLE": "0"}
+
+    env = ccache_defaults_env(get_idf_tools_path() / "ccache")
+    # Exactly one canonical spelling ever reaches idf.py, whatever the
+    # accepted input spelling was ("enable", "yes", ...)
+    env["IDF_CCACHE_ENABLE"] = "1"
+    return env
 
 
 def get_framework_env(

esphome/espidf/toolchain.py

@@ -528,25 +528,6 @@ def run_compile(config, verbose: bool) -> int:
             return result.returncode
         _patch_memory_segments()
 
-    # After every reconfigure so compile_commands and sdkconfig are settled.
-    # An optional speedup must never abort the build
-    from esphome.build_gen.espidf import discard_pch, prepare_pch
-
-    try:
-        prepare_pch()
-    except Exception:  # noqa: BLE001  # pylint: disable=broad-exception-caught
-        from esphome.build_helpers.pch import pch_strict
-
-        # Strict first: its own knob error must not mask the real failure
-        strict = pch_strict()
-        # Raises itself if a stale .gch survives (silently wrong output)
-        discard_pch()
-        if strict:
-            raise
-        _LOGGER.warning(
-            "Precompiled header setup failed; compiling without it", exc_info=True
-        )
-
     # Build
     args = []
 

esphome/espota2.py

@@ -202,6 +202,49 @@ class OTANetworkError(OTAError):
     """Network-level OTA failure (timeout, reset, closed connection); retrying may succeed."""
 
 
+# Remove before 2027.3.0
+class OTAEncryptionFallback(OTAError):
+    """The encrypted attempt failed and the caller may retry in plaintext."""
+
+
+# Remove before 2027.3.0
+PLAINTEXT_FALLBACK_NOTICE = (
+    "A device with an api encryption key offers encryption after this "
+    "install; add 'encryption:' under 'ota: platform: esphome' to require it. "
+    "This plaintext fallback is removed in 2027.3.0."
+)
+
+
+# Remove before 2027.3.0
+class _EncryptionAttempt:
+    """The key an upload tries and whether it may fall back to plaintext;
+    a rejected handshake falls back at once, a transport fault only on repeat."""
+
+    def __init__(self, noise_psk: str | None, plaintext_fallback: bool) -> None:
+        self.noise_psk = noise_psk
+        self.plaintext_fallback = plaintext_fallback
+        self.handshake_faults = 0
+
+    def handshake_fault_falls_back(self) -> bool:
+        self.handshake_faults += 1
+        return self.plaintext_fallback and self.handshake_faults >= 2
+
+    def downgrade(self, reason: str) -> None:
+        _LOGGER.warning(
+            "%s. Retrying in plaintext; a device that requires encryption "
+            "refuses it. %s",
+            reason,
+            PLAINTEXT_FALLBACK_NOTICE,
+        )
+        self.noise_psk = None
+        self.plaintext_fallback = False
+
+
+# Remove before 2027.3.0: only the fallback decision needs this distinction
+class OTAHandshakeNetworkError(OTANetworkError):
+    """A transport failure inside the noise handshake; retrying encrypted may succeed."""
+
+
 def _committed_error(err: OTANetworkError) -> OTAError:
     """Wrap a network failure that happened once the device had the full image.
 
@@ -464,6 +507,7 @@ def perform_ota(
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
     noise_psk: str | None = None,
+    plaintext_fallback: bool = False,
 ) -> None:
     # Validate up front; an out-of-range value would only surface as a
     # ValueError deep inside send_check, bypassing OTAError handling
@@ -528,19 +572,28 @@ def perform_ota(
     else:
         features = 0
 
-    if noise_psk:
-        # Fail closed: never fall back to a plaintext upload when an
-        # encryption key is configured, an active attacker could otherwise
-        # strip the feature flag and capture the image (it contains the wifi
-        # credentials and the api encryption key).
-        if not (extended_proto and features & SERVER_FEATURE_SUPPORTS_NOISE):
+    if noise_psk and not (extended_proto and features & SERVER_FEATURE_SUPPORTS_NOISE):
+        if plaintext_fallback:
+            # Remove before 2027.3.0: older firmware that cannot encrypt still
+            # gets its update on this connection
+            _LOGGER.warning(
+                "The device did not offer OTA encryption; continuing in plaintext. %s",
+                PLAINTEXT_FALLBACK_NOTICE,
+            )
+            noise_psk = None
+        else:
+            # Fail closed: an attacker could otherwise strip the offer and
+            # capture the image (wifi credentials, api key)
             raise OTAError(
                 "An OTA encryption key is configured but the device did not "
                 "offer encryption; refusing to send the image in plaintext. "
-                "If the running firmware predates OTA encryption, first update "
-                "it without the 'ota: encryption:' block (over a trusted "
-                "network or via USB), then restore the block and upload again."
+                "The running firmware predates ESPHome 2026.9.0 or has no "
+                "'api: encryption: key'. With an api key, install once "
+                "without the 'ota: encryption:' block (that build offers "
+                "encryption), then restore it; otherwise flash by serial or "
+                "the web_server OTA platform."
             )
+    if noise_psk:
         # The prologue binds every negotiation byte both sides saw, so any
         # tampering with the plaintext preamble breaks the handshake.
         prologue = (
@@ -549,8 +602,18 @@ def perform_ota(
             + bytes([RESPONSE_OK, version, features_to_send])
             + bytes([RESPONSE_FEATURE_FLAGS, features])
         )
+        # Built outside the try: a local failure must never downgrade the upload
         sock = NoiseSocketWrapper(sock, noise_psk, prologue)
-        sock.do_handshake()
+        try:
+            sock.do_handshake()
+        except OTANetworkError as err:
+            # A transport fault: retry encrypted before considering plaintext
+            raise OTAHandshakeNetworkError(str(err)) from err
+        except OTAError as err:
+            # Remove before 2027.3.0
+            if plaintext_fallback:
+                raise OTAEncryptionFallback(str(err)) from err
+            raise
         _LOGGER.info("Encrypted connection established")
 
     if ota_type != OTA_TYPE_UPDATE_APP:
@@ -757,6 +820,7 @@ def run_ota_impl_(
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
     noise_psk: str | None = None,
+    plaintext_fallback: bool = False,
 ) -> tuple[int, str | None]:
     from esphome.core import CORE
 
@@ -795,7 +859,9 @@ def run_ota_impl_(
     total_attempts = len(res) + EXTRA_UPLOAD_ATTEMPTS
     last_error = ""
     reached_device = False
-    for attempt in range(total_attempts):
+    attempt = 0
+    encryption = _EncryptionAttempt(noise_psk, plaintext_fallback)
+    while attempt < total_attempts:
         af, socktype, _, _, sa = res[attempt % len(res)]
         if reached_device or attempt >= len(res):
             _LOGGER.info(
@@ -815,17 +881,40 @@ def run_ota_impl_(
             sock.close()
             _LOGGER.warning("Connecting to %s port %s failed: %s", sa[0], sa[1], err)
             last_error = f"connecting to {sa[0]} failed: {err}"
+            attempt += 1
             continue
 
         _LOGGER.info("Connected to %s", sa[0])
         reached_device = True
         with contextlib.closing(sock), Path(filename).open("rb") as file_handle:
             try:
-                perform_ota(sock, password, file_handle, filename, ota_type, noise_psk)
+                perform_ota(
+                    sock,
+                    password,
+                    file_handle,
+                    filename,
+                    ota_type,
+                    encryption.noise_psk,
+                    encryption.plaintext_fallback,
+                )
+            except OTAEncryptionFallback as err:
+                # Same address and attempt budget: not a network retry
+                last_error = str(err)
+                encryption.downgrade(last_error)
+                continue
+            except OTAHandshakeNetworkError as err:
+                last_error = str(err)
+                if encryption.handshake_fault_falls_back():
+                    encryption.downgrade(last_error)
+                    continue
+                _LOGGER.warning("%s", last_error)
+                attempt += 1
+                continue
             except OTANetworkError as err:
                 # Transient network failure; retry
                 last_error = str(err)
                 _LOGGER.warning("%s", last_error)
+                attempt += 1
                 continue
             except OTAError as err:
                 # Device-reported error (wrong password, wrong flash size, ...);
@@ -847,10 +936,17 @@ def run_ota(
     filename: Path,
     ota_type: int = OTA_TYPE_UPDATE_APP,
     noise_psk: str | None = None,
+    plaintext_fallback: bool = False,
 ) -> tuple[int, str | None]:
     try:
         return run_ota_impl_(
-            remote_host, remote_port, password, filename, ota_type, noise_psk
+            remote_host,
+            remote_port,
+            password,
+            filename,
+            ota_type,
+            noise_psk,
+            plaintext_fallback,
         )
     except OTAError as err:
         _LOGGER.error(err)

esphome/platformio/pch.py.script

@@ -1,416 +0,0 @@
-import hashlib
-import os
-from pathlib import Path
-import posixpath
-import re
-import shlex
-import stat
-import subprocess
-import traceback
-
-# pylint: disable=E0602
-Import("env")  # noqa: F821
-_projenv_error = None
-try:
-    Import("projenv")  # noqa: F821
-except Exception as err:  # noqa: BLE001 -- not exported under -t nobuild
-    projenv = None
-    _projenv_error = err
-
-# Precompile the src force-includes plus defines.h and force-include the
-# result into C++ src compiles only; their preprocessed output is unchanged.
-# Registration is gated host-side (pch_enabled()). Keep the closure, ccache
-# values, probe flow, stamp flow, and env-knob spellings in sync with
-# build_helpers/pch.py.
-
-# Compiler failures that clear on their own must not latch the .failed marker
-_TRANSIENT_ERRORS = ("No space left", "Cannot allocate", "Resource temporarily")
-
-# Keep in sync with helpers.TRUTHY_ENV_STRINGS / FALSY_ENV_STRINGS
-_TRUTHY = ("1", "true", "yes", "on", "enable")
-_FALSY = ("", "0", "false", "no", "off", "disable")
-_STRICT_RAW = os.environ.get("ESPHOME_PCH_STRICT")
-_STRICT_VALUE = (_STRICT_RAW or "").strip().lower()
-_STRICT = _STRICT_VALUE in _TRUTHY
-if _STRICT_RAW is not None and _STRICT_VALUE not in _TRUTHY + _FALSY:
-    # A typo must not silently turn the gate into a no-op
-    raise RuntimeError(f"Unrecognized ESPHOME_PCH_STRICT={_STRICT_RAW!r}; use 1 or 0")
-
-_INCLUDE_RE = re.compile(rb'^\s*#\s*include\s+["<]([^">]+)[">]', re.MULTILINE)
-_CORE_HEADER = "esphome/core/defines.h"
-
-
-def _raise_walk_error(err: OSError) -> None:
-    raise err
-
-
-def _resolves_dir(path: Path) -> bool:
-    """False when missing; other stat failures propagate."""
-    try:
-        return stat.S_ISDIR(path.stat().st_mode)
-    except (FileNotFoundError, NotADirectoryError):
-        return False
-
-
-def _resolves(path: Path) -> bool:
-    """False when missing; other stat failures propagate (identity unknown)."""
-    try:
-        return stat.S_ISREG(path.stat().st_mode)
-    except (FileNotFoundError, NotADirectoryError):
-        return False
-
-
-def _include_closure(src_dir: Path, roots: list) -> dict:
-    """Quoted-include closure: src-relative name -> contents (mirror of
-    build_helpers/pch.py)."""
-    seen = {}
-    stack = [(name, "") for name in roots]
-    while stack:
-        name, from_dir = stack.pop()
-        for candidate in (f"{from_dir}/{name}" if from_dir else name, name):
-            rel = posixpath.normpath(candidate)
-            if not rel.startswith("..") and _resolves(src_dir / rel):
-                break
-        else:
-            continue
-        if rel in seen:
-            continue
-        try:
-            data = (src_dir / rel).read_bytes()
-        except OSError as err:
-            # A marker would truncate the transitive walk; fail closed
-            print(f"ESPHome: could not read {rel} for the pch checksum: {err}")
-            raise
-        seen[rel] = data
-        parent = posixpath.dirname(rel)
-        stack.extend(
-            (inc.decode(errors="surrogateescape"), parent)
-            for inc in _INCLUDE_RE.findall(data)
-        )
-    return seen
-
-
-def _shell_arg(element) -> str | None:
-    """One compiler argv from one SCons element, matching the real spawn:
-    spaced elements pass whole, the rest get one shell unquote (skipped on
-    Windows, where shlex would eat path backslashes)."""
-    arg = str(element)
-    if " " in arg or os.name == "nt":
-        return arg.replace('\\"', '"')
-    if not arg.strip():
-        return arg
-    try:
-        tokens = shlex.split(arg)
-    except ValueError as err:
-        print(f"ESPHome: could not lex flag {arg!r} for the pch: {err}")
-        return None
-    if len(tokens) != 1:
-        # A flag the model cannot reproduce would diverge the .gch's flags
-        print(f"ESPHome: cannot model flag {arg!r} for the pch")
-        return None
-    return tokens[0]
-
-
-def _compile_gch(cxx, flags, header: Path, gch: Path, proj_dir: Path):
-    """Compile the .gch, then probe that the toolchain can load it back
-    (GCC 10 on macOS arm64 rejects its own per-process). Returns an error
-    string or None; OSError propagates as transient."""
-    result = subprocess.run(  # noqa: PLW1510
-        [cxx, "-x", "c++-header", *flags, "-c", str(header), "-o", str(gch)],
-        cwd=proj_dir,
-        # C locale keeps diagnostics matchable by _TRANSIENT_ERRORS
-        env={**os.environ, "LC_ALL": "C"},
-        capture_output=True,
-        text=True,
-    )
-    if result.returncode < 0:
-        # Signal-killed (OOM, ^C): route to the transient no-marker path
-        raise OSError(f"compiler killed by signal {-result.returncode}")
-    if result.returncode != 0:
-        return result.stderr
-    return _probe_gch(cxx, flags, header, proj_dir)
-
-
-def _probe_run(cxx, flags, extra, proj_dir: Path):
-    probe = subprocess.run(  # noqa: PLW1510
-        [cxx, *flags, *extra, "-fsyntax-only", "-x", "c++", "-"],
-        cwd=proj_dir,
-        env={**os.environ, "LC_ALL": "C"},
-        input="",
-        capture_output=True,
-        text=True,
-    )
-    if probe.returncode < 0:
-        raise OSError(f"probe killed by signal {-probe.returncode}")
-    return probe
-
-
-def _probe_gch(cxx, flags, header: Path, proj_dir: Path):
-    """Load-check an existing .gch; error string or None. Rejection must
-    be a nonzero exit (keep in sync with pch_probe_args); a baseline run
-    without the pch keeps environmental failures from being blamed on it."""
-    # -MF is only legal alongside a dependency flag; pass it solely to
-    # redirect a depfile that -MD/-MMD in the flags would otherwise write
-    dep_redirect = (
-        ["-MF", os.devnull]
-        if any(f in ("-MD", "-MMD", "-M", "-MM") for f in flags)
-        else []
-    )
-    probe = _probe_run(
-        cxx,
-        flags,
-        [*dep_redirect, "-Winvalid-pch", "-Werror=invalid-pch", "-include", str(header)],
-        proj_dir,
-    )
-    if probe.returncode == 0:
-        return None
-    baseline = _probe_run(cxx, flags, dep_redirect, proj_dir)
-    if baseline.returncode != 0:
-        # Deterministic and latchable; the transient filter at the caller
-        # keeps resource exhaustion from latching
-        return f"probe cannot run at all: {baseline.stderr.strip()[:200]}"
-    return f"toolchain cannot load the pch: {probe.stderr.strip()}"
-
-
-def _read_stamp(path: Path) -> str:
-    """A corrupt sidecar must read as stale, not kill the pch forever."""
-    try:
-        return path.read_text(encoding="utf-8").strip()
-    except (OSError, UnicodeDecodeError):
-        return ""
-
-
-def _setup_pch() -> bool | None:
-    if projenv is None:
-        print(f"ESPHome: projenv unavailable ({_projenv_error}); skipping pch")
-        try:
-            from SCons.Script import COMMAND_LINE_TARGETS
-        except ImportError:
-            # No SCons is an anomaly under PlatformIO: the unknown state
-            # must not read as success (strict decides fatality at the gate)
-            return False
-        # Expected under -t nobuild (nothing compiles); a missing
-        # projenv on a real compile must not pass strict
-        return "nobuild" in [str(t) for t in COMMAND_LINE_TARGETS]
-    # Project root: SCons compiles run here, so the relative -include
-    # resolves; an absolute path would break cross-device ccache sharing.
-    proj_dir = Path(env.subst("$PROJECT_DIR"))  # noqa: F821
-    src_dir = Path(env.subst("$PROJECT_SRC_DIR"))  # noqa: F821
-    header = proj_dir / "esphome_pch.h"
-    gch = Path(f"{header}.gch")
-    sum_path = Path(f"{gch}.sum")
-
-    cxx = projenv.subst("$CXX")  # noqa: F821
-    # The header holds the -include entries itself, so the .gch compile must
-    # not see them; consumers keep theirs, which the .gch then satisfies.
-    flags = []
-    include_headers = []
-    raw_args = [
-        _shell_arg(element)
-        for element in projenv.subst_list("$CXXFLAGS $CCFLAGS $_CCCOMCOM")[0]  # noqa: F821
-    ]
-    if any(arg is None for arg in raw_args):
-        print("ESPHome: skipping precompiled header: unmodelable flag")
-        return
-    flag_it = iter(raw_args)
-    for tok in flag_it:
-        if tok == "-include":
-            include_headers.append(next(flag_it, ""))
-        elif tok.startswith("-include") and not tok.startswith("-include-"):
-            include_headers.append(tok[len("-include") :])
-        else:
-            flags.append(tok)
-    if any(not name for name in include_headers):
-        print("ESPHome: build_src_flags has a trailing -include; skipping pch")
-        return
-    # Fold only relative names resolving under src/: consumers keep their
-    # own -include entries, so folding an unguarded user header would
-    # include it twice; unfolded ones stay consumer-only.
-    try:
-        folded = [
-            name
-            for name in include_headers
-            if not Path(name).is_absolute() and _resolves(src_dir / name)
-        ]
-    except OSError as err:
-        print(f"ESPHome: skipping precompiled header: {err}")
-        return
-    if unfolded := [n for n in include_headers if n not in folded]:
-        print(f"ESPHome: not precompiling non-src force-includes: {unfolded}")
-    content = "".join(f'#include "{name}"\n' for name in (*folded, _CORE_HEADER))
-
-    digest = hashlib.sha256()
-    digest.update(content.encode(errors="surrogateescape"))
-    digest.update(cxx.encode(errors="surrogateescape"))
-    # Mirror CCACHE_BASEDIR: strip the per-device build path so identical
-    # configs produce identical .sum files and share cache entries
-    flags_id = " ".join(flags)
-    if basedir := os.environ.get("CCACHE_BASEDIR"):
-        flags_id = flags_id.replace(basedir, "")
-    digest.update(flags_id.encode(errors="surrogateescape"))
-    # GCC never validates a .gch against its source headers, and PlatformIO
-    # package paths carry no version, so a package bump must invalidate here
-    platform = env.PioPlatform()  # noqa: F821
-    for package in sorted(platform.packages):
-        try:
-            version = platform.get_package_version(package)
-        except KeyError:
-            # An unresolved manifest must not hash as a constant
-            if platform.get_package(package) is not None:
-                print(f"ESPHome: skipping precompiled header: no version for {package}")
-                return
-            version = None  # absent optional package
-        except Exception as err:  # noqa: BLE001
-            # No trustworthy package identity: a stale .gch could survive
-            print(f"ESPHome: skipping precompiled header: {err}")
-            return
-        digest.update(f"{package}={version}".encode())
-        digest.update(b"\0")
-    try:
-        closure = _include_closure(src_dir, [*folded, _CORE_HEADER])
-    except OSError as err:
-        print(f"ESPHome: skipping precompiled header: {err}")
-        return
-    for rel in sorted(closure):
-        digest.update(rel.encode(errors="surrogateescape"))
-        digest.update(closure[rel])
-        digest.update(b"\0")
-    # Project-local -I dirs (e.g. rp2's lwip_override) hold generated
-    # headers the src closure cannot see; hash them too
-    prev = ""
-    try:
-        for tok in flags:
-            inc = tok[2:] if tok.startswith("-I") and len(tok) > 2 else ""
-            if prev == "-I":
-                inc = tok
-            prev = tok
-            if not inc:
-                continue
-            inc_dir = Path(inc)
-            if not (
-                _resolves_dir(inc_dir)
-                and inc_dir.is_relative_to(proj_dir)
-                and not inc_dir.is_relative_to(src_dir)
-                # Library trees never enter the prefix closure; walking them
-                # would read every library file each build
-                and not inc_dir.is_relative_to(proj_dir / ".piolibdeps")
-                and not inc_dir.is_relative_to(proj_dir / ".pioenvs")
-            ):
-                continue
-            local_headers = []
-            # os.walk with onerror: rglob would swallow unlistable subtrees
-            for root, _dirs, files in os.walk(inc_dir, onerror=_raise_walk_error):
-                local_headers.extend(
-                    Path(root) / f
-                    for f in files
-                    if f.endswith((".h", ".hpp", ".hh", ".inc"))
-                )
-            for local in sorted(local_headers):
-                digest.update(str(local.relative_to(proj_dir)).encode())
-                digest.update(local.read_bytes())
-                digest.update(b"\0")
-    except OSError as err:
-        print(f"ESPHome: skipping precompiled header: {err}")
-        return
-    checksum = digest.hexdigest()
-
-    # The ccache .sum sidecar doubles as the freshness stamp
-    fresh = (
-        header.is_file()
-        and gch.is_file()
-        and sum_path.is_file()
-        and (_read_stamp(sum_path) == checksum)
-    )
-    if fresh and _STRICT:
-        # Rejection is per-process: strict re-proves a cached .gch loads
-        # (mirrors the pch_strict() re-probe in build_helpers/pch.py)
-        error = _probe_gch(cxx, flags, header, proj_dir)
-        if error is not None:
-            print(f"ESPHome: {error}")
-            gch.unlink(missing_ok=True)
-            sum_path.unlink(missing_ok=True)
-            return
-    if not fresh:
-        failed_marker = Path(f"{gch}.failed")
-        if _read_stamp(failed_marker) == checksum:
-            print(
-                "ESPHome: skipping precompiled header (previous attempt "
-                f"failed); delete {failed_marker.name} to retry"
-            )
-            return
-        header.write_text(content, encoding="utf-8")
-        try:
-            error = _compile_gch(cxx, flags, header, gch, proj_dir)
-        except OSError as err:
-            # Transient spawn/IO failure: no marker, retry next build
-            print(f"ESPHome: precompiled header compile did not run: {err}")
-            gch.unlink(missing_ok=True)
-            sum_path.unlink(missing_ok=True)
-            return
-        if error is not None:
-            print("ESPHome: precompiled header failed; compiling without it")
-            print(error)
-            gch.unlink(missing_ok=True)
-            sum_path.unlink(missing_ok=True)
-            if any(m in error for m in _TRANSIENT_ERRORS):
-                # Resource exhaustion clears on its own; retry next build
-                return
-            # Skip retries until a flag/header/platform change alters the checksum
-            failed_marker.write_text(checksum + "\n", encoding="utf-8")
-            return
-        failed_marker.unlink(missing_ok=True)
-        sum_path.write_text(checksum + "\n", encoding="utf-8")
-
-    # Computed first so the flags and env land together: a raise between
-    # them would leave a pch-consuming build without its ccache settings.
-    # projenv["ENV"] aliases os.environ, so these reach all TUs; only
-    # time_macros affects non-pch TUs. User values win.
-    ccache_updates = {
-        key: value
-        for key, value in (
-            ("CCACHE_SLOPPINESS", "pch_defines,time_macros"),
-            ("CCACHE_PCH_EXTSUM", "true"),
-        )
-        if key not in os.environ
-    }
-    sloppiness = os.environ.get("CCACHE_SLOPPINESS")
-    if sloppiness is not None:
-        tokens = {tok.strip() for tok in sloppiness.split(",")}
-        missing = [t for t in ("pch_defines", "time_macros") if t not in tokens]
-        if missing:
-            # Without these ccache declines every pch-consuming compile
-            ccache_updates["CCACHE_SLOPPINESS"] = ",".join((sloppiness, *missing))
-            print(f"ESPHome: adding {','.join(missing)} to CCACHE_SLOPPINESS for the pch")
-    extsum = os.environ.get("CCACHE_PCH_EXTSUM")
-    if extsum is not None and extsum.strip().lower() not in ("1", "true", "yes", "on"):
-        # ccache then hashes the non-reproducible .gch bytes: permanent misses
-        print(f"ESPHome: CCACHE_PCH_EXTSUM={extsum} disables pch caching")
-    # Prepended: GCC only uses a .gch while no other tokens precede it.
-    # The relative name also reaches "pio run -t idedata" output.
-    # -Wno-error: the per-process probe can pass while a later cc1plus
-    # rejects the .gch; that must stay a warning under user -Werror.
-    projenv.Prepend(  # noqa: F821
-        CXXFLAGS=[
-            "-Winvalid-pch",
-            # Strict inverts: a per-process consumer rejection reds the build
-            "-Werror=invalid-pch" if _STRICT else "-Wno-error=invalid-pch",
-            "-include",
-            header.name,
-        ]
-    )
-    projenv["ENV"].update(ccache_updates)  # noqa: F821
-    print("ESPHome: Compiling with precompiled header")
-    return True
-
-
-
-try:
-    _used = _setup_pch()
-except Exception:  # noqa: BLE001 -- a speedup must never break the build
-    if _STRICT:
-        raise
-    print("ESPHome: pch internal error; compiling without it")
-    traceback.print_exc()
-else:
-    if _STRICT and not _used:
-        raise RuntimeError("ESPHOME_PCH_STRICT: precompiled header was not used")

esphome/platformio/toolchain.py

@@ -289,15 +289,6 @@ def copy_ccache_script() -> None:
     )
 
 
-def copy_pch_script() -> None:
-    """Copy the shared precompiled-header SCons post-script into the build
-    dir; platform components pair it with ``post:pch.py`` in extra_scripts."""
-    copy_file_if_changed(
-        Path(__file__).parent / "pch.py.script",
-        CORE.relative_build_path("pch.py"),
-    )
-
-
 def default_libdeps_dir() -> str:
     """The PLATFORMIO_LIBDEPS_DIR value a pio run defaults to; the package
     prefetch must resolve installed libraries against the same dir."""

esphome/wizard.py

@@ -148,11 +148,13 @@ def wizard_file(**kwargs: Unpack[WizardFileKwargs]) -> str:
     if "api_encryption_key" in kwargs:
         config += f'  encryption:\n    key: "{kwargs["api_encryption_key"]}"\n'
 
-    # Configure OTA
+    # The api key also secures OTA; a password only serves older uploaders
     config += "\nota:\n"
     config += "  - platform: esphome\n"
     if "ota_password" in kwargs:
         config += f'    password: "{kwargs["ota_password"]}"'
+    elif "api_encryption_key" in kwargs:
+        config += "    encryption:"
 
     # Configuring wifi
     config += "\n\nwifi:\n"
@@ -529,20 +531,9 @@ def wizard(path: Path) -> int:
         safe_print()
         safe_print("You'll need this key when adding the device to Home Assistant.")
         sleep(1)
-
-        safe_print()
-        safe_print(
-            f"Do you want to set a {color(AnsiFore.GREEN, 'password')} for OTA updates? "
-            "This can be insecure if you do not trust the WiFi network."
-        )
-        safe_print()
-        sleep(0.25)
-        safe_print("Press ENTER for no password")
-        ota_password = safe_input(color(AnsiFore.BOLD_WHITE, "(password): "))
     else:
         ssid, psk = "", ""
         api_encryption_key = None
-        ota_password = ""
 
     kwargs = {
         "path": path,
@@ -553,10 +544,9 @@ def wizard(path: Path) -> int:
         "psk": psk,
         "type": "basic",
     }
+    # The api key also secures OTA updates, so the wizard sets no OTA password
     if api_encryption_key:
         kwargs["api_encryption_key"] = api_encryption_key
-    if ota_password:
-        kwargs["ota_password"] = ota_password
 
     if not wizard_write(**kwargs):
         return 1

esphome/writer.py

@@ -7,7 +7,6 @@ import re
 import time
 
 from esphome import loader
-from esphome.build_helpers.pch import PCH_ARTIFACT_NAMES
 from esphome.compiled_config import save_compiled_config
 from esphome.config import iter_component_configs, iter_components
 from esphome.const import (
@@ -247,7 +246,6 @@ def copy_src_tree():
         Path(
             "esphome/core/ring_buffer.h"
         ),  # moved to components/ring_buffer/, removed in 2026.11.0
-        Path("esphome/core/pch_prefix.h"),  # build machinery, not user API
     }
     include_l = []
     for target, _ in source_files_l:
@@ -611,20 +609,11 @@ def clean_build(clear_pio_cache: bool = True, *, full: bool = False):
             if idf_path.is_dir():
                 _LOGGER.info("Deleting %s", idf_path)
                 rmtree(idf_path)
-        # The PlatformIO pch artifacts live at the project root so the
-        # relative -include resolves; a partial clean must drop them too
-        for name in PCH_ARTIFACT_NAMES:
-            CORE.relative_build_path(name).unlink(missing_ok=True)
 
-    # The idedata caches are derived from the build but live under the data
-    # dir, not the build path, so they must be removed separately in both
-    # modes. Globbed (name.json plus name.<backend>.json) so a future
-    # backend suffix cannot silently drift out of clean-all.
-    idedata_dir = CORE.relative_internal_path("idedata")
-    for idedata_cache in (
-        *idedata_dir.glob(f"{CORE.name}.json"),
-        *idedata_dir.glob(f"{CORE.name}.*.json"),
-    ):
+    # The idedata cache is derived from the build but lives under the data dir,
+    # not the build path, so it must be removed separately in both modes.
+    idedata_cache = CORE.relative_internal_path("idedata", f"{CORE.name}.json")
+    if idedata_cache.is_file():
         _LOGGER.info("Deleting %s", idedata_cache)
         idedata_cache.unlink()
 

requirements.txt

@@ -27,7 +27,7 @@ bleak==3.0.2
 smpclient==7.2.0
 requests==2.34.2
 py7zr==1.1.3
-platformdirs==4.11.5  # native esp-idf toolchain global cache dir
+platformdirs==4.11.7  # native esp-idf toolchain global cache dir
 ninja==1.13.2  # native esp8266 arduino toolchain build driver
 filelock==3.32.5  # inter-process locks (PlatformIO cache heal, git clone cache); >=3.32 for FileLock(fallback_to_soft=...), older versions silently drop the kwarg
 

requirements_test.txt

@@ -2,7 +2,7 @@ pylint==4.0.8
 flake8==7.3.0  # also change in .pre-commit-config.yaml when updating
 ruff==0.16.5  # also change in .pre-commit-config.yaml when updating
 pyupgrade==3.21.2  # also change in .pre-commit-config.yaml when updating
-prek==0.5.0  # also change in .github/workflows/ci.yml when updating
+prek==0.5.1  # also change in .github/workflows/ci.yml when updating
 
 # Unit tests
 pytest==9.1.1

script/determine-jobs.py

@@ -50,7 +50,6 @@ from __future__ import annotations
 
 import argparse
 from collections import Counter
-from collections.abc import Callable
 from enum import StrEnum
 from functools import cache
 import json
@@ -532,53 +531,37 @@ ESP32_PLATFORMIO_TRIGGER_PATH_PREFIXES = ("esphome/platformio/",)
 #   - esphome/build_gen/platformio.py -- the PlatformIO build generator
 #   - script/test_build_components.py -- the harness the job invokes
 #   - .github/workflows/ci.yml -- the job's own definition
-# Shared by every toolchain smoke-test job: the harness it invokes and the
-# workflow that defines it
-_SMOKE_HARNESS_TRIGGER_FILES = frozenset(
+ESP32_PLATFORMIO_TRIGGER_FILES = frozenset(
     {
+        "esphome/build_gen/platformio.py",
         "script/test_build_components.py",
         ".github/workflows/ci.yml",
     }
 )
 
-ESP32_PLATFORMIO_TRIGGER_FILES = _SMOKE_HARNESS_TRIGGER_FILES | {
-    "esphome/build_gen/platformio.py",
-}
-
-
-def _path_or_file_trigger(
-    files: list[str],
-    trigger_files: frozenset[str],
-    trigger_prefixes: tuple[str, ...],
-) -> bool:
-    """Whether any changed file matches the given infrastructure triggers."""
-    return any(
-        file in trigger_files or file.startswith(trigger_prefixes) for file in files
-    )
-
-
-@cache
-def _cached_components_closure(files: tuple[str, ...]) -> frozenset[str]:
-    """Dependency closure of the changed components, from the changed files.
-
-    The walk is expensive and every toolchain smoke-test job asks for the
-    same file list, so compute it once per run."""
-    component_files = [f for f in files if filter_component_and_test_files(f)]
-    return frozenset(get_components_with_dependencies(component_files, True))
-
 
 def _esp32_platformio_path_or_file_trigger(files: list[str]) -> bool:
     """Whether any changed file is a PlatformIO infrastructure / harness trigger."""
-    return _path_or_file_trigger(
-        files, ESP32_PLATFORMIO_TRIGGER_FILES, ESP32_PLATFORMIO_TRIGGER_PATH_PREFIXES
-    )
+    for file in files:
+        if file in ESP32_PLATFORMIO_TRIGGER_FILES:
+            return True
+        if any(
+            file.startswith(prefix) for prefix in ESP32_PLATFORMIO_TRIGGER_PATH_PREFIXES
+        ):
+            return True
+    return False
 
 
 def _esp_idf_infra_changed(files: list[str]) -> bool:
     """Whether any changed file is ESP-IDF build/runner infrastructure."""
-    return _path_or_file_trigger(
-        files, ESP_IDF_INFRA_TRIGGER_FILES, ESP_IDF_INFRA_TRIGGER_PATH_PREFIXES
-    )
+    for file in files:
+        if file in ESP_IDF_INFRA_TRIGGER_FILES:
+            return True
+        if any(
+            file.startswith(prefix) for prefix in ESP_IDF_INFRA_TRIGGER_PATH_PREFIXES
+        ):
+            return True
+    return False
 
 
 def esp32_platformio_components_to_test(branch: str | None = None) -> list[str]:
@@ -616,23 +599,15 @@ def esp32_platformio_components_to_test(branch: str | None = None) -> list[str]:
     Returns:
         Sorted list of component names to compile.
     """
-    return _toolchain_components_to_test(
-        branch, ESP32_PLATFORMIO_TEST_COMPONENTS, _esp32_platformio_path_or_file_trigger
-    )
-
-
-def _toolchain_components_to_test(
-    branch: str | None,
-    test_set: frozenset[str],
-    infra_trigger: Callable[[list[str]], bool],
-) -> list[str]:
-    """The shared narrowing rule for the per-toolchain smoke-test jobs."""
     files = changed_files(branch)
 
-    if core_changed(files) or infra_trigger(files):
-        return sorted(test_set)
+    if core_changed(files) or _esp32_platformio_path_or_file_trigger(files):
+        return sorted(ESP32_PLATFORMIO_TEST_COMPONENTS)
 
-    return sorted(test_set & _cached_components_closure(tuple(files)))
+    component_files = [f for f in files if filter_component_and_test_files(f)]
+    changed = get_components_with_dependencies(component_files, True)
+
+    return sorted(ESP32_PLATFORMIO_TEST_COMPONENTS & set(changed))
 
 
 def should_run_esp32_platformio(branch: str | None = None) -> bool:
@@ -653,83 +628,6 @@ def should_run_esp32_platformio(branch: str | None = None) -> bool:
     return bool(esp32_platformio_components_to_test(branch))
 
 
-# The `--toolchain arduino` smoke-test set: covers the core, the bundled and
-# converted registry libraries, and the waveform path.
-ESP8266_NATIVE_TEST_COMPONENTS = frozenset(
-    {
-        "esp8266",
-        "api",
-        "web_server",
-        "captive_portal",
-        "mqtt",
-        "esp8266_pwm",
-        "neopixelbus",
-        "bme280_i2c",
-        "uart",
-    }
-)
-
-# Infrastructure whose changes always trigger the native ESP8266 compile
-# test. esphome/build_helpers/ holds the idedata and size-summary helpers
-# the backend shares with the native ESP-IDF build.
-ESP8266_NATIVE_TRIGGER_PATH_PREFIXES = (
-    "esphome/arduino8266/",
-    "esphome/arduino/",
-    "esphome/build_helpers/",
-)
-# Shared library-conversion modules every native build imports; espidf-only
-# infra (build_gen/espidf.py) deliberately stays out of the esp8266 set.
-_NATIVE_SHARED_TRIGGER_FILES = frozenset(
-    {
-        "esphome/framework_helpers.py",
-        "esphome/platformio/library.py",
-        "esphome/platformio/extra_script.py",
-    }
-)
-# Tripwire: the shared modules must stay in the ESP-IDF trigger set too
-# (now defined in clang_tidy_hash), or its smoke test silently skips them
-assert _NATIVE_SHARED_TRIGGER_FILES <= ESP_IDF_INFRA_TRIGGER_FILES
-ESP8266_NATIVE_TRIGGER_FILES = (
-    _NATIVE_SHARED_TRIGGER_FILES
-    | _SMOKE_HARNESS_TRIGGER_FILES
-    | {
-        "esphome/build_gen/arduino8266.py",
-        "esphome/build_gen/build_tool.py",
-        "esphome/components/esp8266/build_surgery.py",
-        "esphome/components/esp8266/boards.py",
-        "esphome/platformio/registry.py",
-        # esp8266/__init__.py imports copy_ccache_script from it
-        "esphome/platformio/toolchain.py",
-        ".github/actions/cache-arduino8266/action.yml",
-    }
-)
-
-
-def _esp8266_native_path_or_file_trigger(files: list[str]) -> bool:
-    """Whether any changed file is native-ESP8266 infrastructure / harness."""
-    # base_python_changed covers the top-level esphome/*.py modules the
-    # native backend imports directly (framework_helpers, helpers, writer,
-    # __main__); without it a change there would silently skip this job.
-    # base_python_changed is deliberately broad (any top-level esphome/*.py)
-    # as belt-and-braces while the backend is new; narrow it to the modules
-    # the backend imports once the toolchain has soaked a few releases
-    return base_python_changed(files) or _path_or_file_trigger(
-        files, ESP8266_NATIVE_TRIGGER_FILES, ESP8266_NATIVE_TRIGGER_PATH_PREFIXES
-    )
-
-
-def esp8266_native_components_to_test(branch: str | None = None) -> list[str]:
-    """Subset of ``ESP8266_NATIVE_TEST_COMPONENTS`` the job needs to compile.
-
-    Same narrowing logic as ``esp32_platformio_components_to_test``: the full
-    list on core or infrastructure changes, otherwise the intersection with
-    the changed-component dependency closure (empty list skips the job).
-    """
-    return _toolchain_components_to_test(
-        branch, ESP8266_NATIVE_TEST_COMPONENTS, _esp8266_native_path_or_file_trigger
-    )
-
-
 def determine_cpp_unit_tests(
     branch: str | None = None,
 ) -> tuple[bool, list[str]]:
@@ -1328,8 +1226,6 @@ def main() -> None:
         run_device_builder = True
         esp32_platformio_components = sorted(ESP32_PLATFORMIO_TEST_COMPONENTS)
         run_esp32_platformio = True
-        esp8266_native_components = sorted(ESP8266_NATIVE_TEST_COMPONENTS)
-        run_esp8266_native = True
     else:
         integration_run_all, integration_test_files = determine_integration_tests(
             args.branch
@@ -1341,8 +1237,6 @@ def main() -> None:
         run_device_builder = should_run_device_builder(args.branch)
         esp32_platformio_components = esp32_platformio_components_to_test(args.branch)
         run_esp32_platformio = bool(esp32_platformio_components)
-        esp8266_native_components = esp8266_native_components_to_test(args.branch)
-        run_esp8266_native = bool(esp8266_native_components)
     run_integration, integration_test_buckets = _compute_integration_test_buckets(
         integration_run_all, integration_test_files
     )
@@ -1538,8 +1432,6 @@ def main() -> None:
         "device_builder": run_device_builder,
         "esp32_platformio": run_esp32_platformio,
         "esp32_platformio_components": ",".join(esp32_platformio_components),
-        "esp8266_native": run_esp8266_native,
-        "esp8266_native_components": ",".join(esp8266_native_components),
         "changed_components": changed_components,
         "changed_components_with_tests": changed_components_with_tests,
         "directly_changed_components_with_tests": list(directly_changed_with_tests),

script/test_build_components.py

@@ -1027,7 +1027,6 @@ def test_components(
     isolated_components: set[str] | None = None,
     base_only: bool = False,
     toolchain: str | None = None,
-    fail_on_no_tests: bool = False,
 ) -> int:
     """Test components with optional intelligent grouping.
 
@@ -1062,34 +1061,20 @@ def test_components(
     # toolchain build.
     include_validate = esphome_command != "compile"
 
-    # Find all component tests; remember which components each pattern
-    # (wildcards included) matched, for the deferred no-tests accounting
+    # Find all component tests
     all_tests = {}
-    pattern_components: dict[str, set[str]] = {}
     for pattern in component_patterns:
         # Skip empty patterns (happens when components list is empty string)
         if not pattern:
             continue
-        found = find_component_tests(
-            tests_dir, pattern, base_only, include_validate=include_validate
+        all_tests.update(
+            find_component_tests(
+                tests_dir, pattern, base_only, include_validate=include_validate
+            )
         )
-        pattern_components[pattern] = set(found)
-        all_tests.update(found)
-
-    # The flag's contract is "no test matched fails": a fully blank pattern
-    # list would otherwise slide into the reference-baseline fallback and
-    # exit green while building nothing a caller asked for
-    if fail_on_no_tests and not any(component_patterns):
-        print("No components requested (blank component list)")
-        return 1
-
-    if fail_on_no_tests and not all_tests:
-        # Nothing matched at all: fail before the synthetic baseline build,
-        # which would spend a compile reporting success on nothing. Partial
-        # matches defer to the per-pattern accounting after the summary.
-        print(f"No components found matching: {component_patterns}")
-        return 1
 
+    # If no components found, build a reference configuration for baseline comparison
+    # Create a synthetic "empty" component test that will build just the base config
     if not all_tests:
         print(f"No components found matching: {component_patterns}")
         print(
@@ -1193,26 +1178,6 @@ def test_components(
                         toolchain=toolchain,
                     )
 
-    silent: list[str] = []
-    if fail_on_no_tests:
-        # A green run that built nothing for a requested pattern (renamed
-        # fixture, missing base file, version-suffix mismatch, a wildcard
-        # matching no component) must not pass CI. Per pattern: an
-        # all-or-nothing check would let one silent pattern hide behind the
-        # others. Opt-in: some legs (the esp32-ard smoke subset)
-        # legitimately match nothing. Failing is deferred past the summary
-        # so a real failure's reproduce commands still print.
-        built = {c for r in test_results for c in r.components}
-        # A pattern is silent when it matched no fixture, or when none of
-        # its matched components produced a build (wildcards included)
-        silent = [
-            p
-            for p in component_patterns
-            if p and not (pattern_components.get(p, set()) & built)
-        ]
-        if silent:
-            print(f"No tests ran for requested pattern(s): {', '.join(silent)}")
-
     # Separate results into passed and failed
     passed_results = [r for r in test_results if r.success]
     failed_results = [r for r in test_results if not r.success]
@@ -1244,7 +1209,7 @@ def test_components(
     if os.environ.get("GITHUB_STEP_SUMMARY"):
         write_github_summary(test_results, toolchain=toolchain)
 
-    if failed_results or silent:
+    if failed_results:
         return 1
 
     return 0
@@ -1299,12 +1264,6 @@ def main() -> int:
         "--toolchain",
         help="Select toolchain for compiling.",
     )
-    parser.add_argument(
-        "--fail-on-no-tests",
-        action="store_true",
-        help="Exit non-zero when no test matched (for CI legs whose "
-        "components must all have fixtures)",
-    )
 
     args = parser.parse_args()
 
@@ -1323,7 +1282,6 @@ def main() -> int:
         continue_on_fail=args.continue_on_fail,
         enable_grouping=not args.no_grouping,
         isolated_components=isolated_components,
-        fail_on_no_tests=args.fail_on_no_tests,
         base_only=args.base_only,
         toolchain=args.toolchain,
     )

tests/component_tests/esp32_ble_server/config/improv_only.yaml

@@ -0,0 +1,13 @@
+esphome:
+  name: test
+
+esp32:
+  variant: esp32
+
+wifi:
+  ssid: MySSID
+  password: password1
+
+# esp32_ble_server is only auto-loaded here, so it has no services of its own.
+esp32_improv:
+  authorizer: none

tests/component_tests/esp32_ble_server/config/manufacturer_data_only.yaml

@@ -0,0 +1,9 @@
+esphome:
+  name: test
+
+esp32:
+  variant: esp32
+
+esp32_ble_server:
+  id: ble_server
+  manufacturer_data: [0x72, 0x04, 0x00, 0x23]

tests/component_tests/esp32_ble_server/config/own_service.yaml

@@ -0,0 +1,14 @@
+esphome:
+  name: test
+
+esp32:
+  variant: esp32
+
+esp32_ble_server:
+  id: ble_server
+  services:
+    - uuid: 2a24b789-7aab-4535-af3e-ee76a35cc12d
+      characteristics:
+        - uuid: cad48e28-7fbe-41cf-bae9-d77a6c233423
+          read: true
+          value: [1, 2, 3, 4]

tests/component_tests/esp32_ble_server/test_esp32_ble_server.py

@@ -1,5 +1,10 @@
 """Tests for esp32_ble_server configuration helpers."""
 
+from __future__ import annotations
+
+from collections.abc import Callable
+from pathlib import Path
+
 import pytest
 
 from esphome.components.esp32_ble_server import (
@@ -45,3 +50,26 @@ def test_uuid_is_matches_descriptor_short_strings(uuid16) -> None:
     assert uuid_is(uuid16, uuid16)
     assert uuid_is(f"{uuid16:04X}", uuid16)
     assert uuid_is(f"{uuid16:08X}", uuid16)
+
+
+@pytest.mark.parametrize(
+    ("config_file", "required"),
+    [
+        # Auto-loaded by esp32_improv only: nothing to find until Improv asks for it
+        ("improv_only.yaml", False),
+        # The configuration defines a service clients are meant to connect to
+        ("own_service.yaml", True),
+        # Manufacturer data is only useful if it is actually broadcast
+        ("manufacturer_data_only.yaml", True),
+    ],
+)
+def test_advertising_required(
+    generate_main: Callable[[str | Path], str],
+    component_config_path: Callable[[str], Path],
+    config_file: str,
+    required: bool,
+) -> None:
+    """The server only requests advertising when the configuration needs it."""
+    main_cpp = generate_main(component_config_path(config_file))
+
+    assert f"set_advertising_required({str(required).lower()})" in main_cpp

tests/component_tests/noise/test_encryption_key.py

@@ -5,11 +5,7 @@ from __future__ import annotations
 import pytest
 
 from esphome import config_validation as cv
-from esphome.components.noise import (
-    decode_encryption_key,
-    is_reserved_key,
-    validate_encryption_key,
-)
+from esphome.components.noise import decode_encryption_key, validate_encryption_key
 
 KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
 
@@ -41,6 +37,8 @@ def test_decode_encryption_key_rejects_short_decode() -> None:
         decode_encryption_key("AAECAw==")
 
 
-def test_is_reserved_key() -> None:
-    assert is_reserved_key("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
-    assert not is_reserved_key(KEY)
+def test_validate_encryption_key_rejects_all_zeros() -> None:
+    """The all-zeros key is the provisioning sentinel the device treats as no
+    key, so it never reaches a build."""
+    with pytest.raises(cv.Invalid, match="all-zeros key is reserved"):
+        validate_encryption_key("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")

tests/component_tests/ota/test_esphome_ota.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Callable
 import logging
 from typing import Any
 
@@ -14,6 +15,7 @@ from esphome.components.esphome.ota import (
     _validate_no_password_with_encryption,
     ota_esphome_final_validate,
 )
+from esphome.components.noise import static_encryption_key
 from esphome.const import (
     CONF_API,
     CONF_ENCRYPTION,
@@ -115,7 +117,6 @@ def test_non_esphome_ota_unaffected() -> None:
 
 API_KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
 OTHER_KEY = "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyA="
-ZEROS_KEY = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
 
 
 def test_encryption_key_inherited_from_api() -> None:
@@ -197,36 +198,6 @@ def test_encryption_without_any_key_rejected() -> None:
         fv.full_config.reset(token)
 
 
-def test_encryption_explicit_all_zeros_key_rejected() -> None:
-    """The all-zeros key is the provisioning sentinel; the device would treat
-    it as no PSK and accept plaintext, so it must fail validation."""
-    full_conf = {
-        CONF_OTA: [
-            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: ZEROS_KEY}})
-        ],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="all-zeros key is reserved"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)
-
-
-def test_encryption_inherited_all_zeros_key_rejected() -> None:
-    """An all-zeros api key must not silently disable ota encryption either."""
-    full_conf = {
-        CONF_API: {CONF_ENCRYPTION: {CONF_KEY: ZEROS_KEY}},
-        CONF_OTA: [_make_ota_config(port=3232, **{CONF_ENCRYPTION: {}})],
-    }
-    token = fv.full_config.set(full_conf)
-    try:
-        with pytest.raises(cv.Invalid, match="all-zeros key is reserved"):
-            ota_esphome_final_validate({})
-    finally:
-        fv.full_config.reset(token)
-
-
 def test_encryption_key_mismatch_between_merged_configs_rejected() -> None:
     """Same-port configs with different encryption keys raise."""
     full_conf = {
@@ -295,13 +266,14 @@ def test_encryption_explicit_key_with_runtime_provisioned_api_accepted() -> None
         fv.full_config.reset(token)
 
 
+@pytest.mark.parametrize("component", ["web_server", "prometheus"])
 def test_encryption_with_web_server_ota_warns(
-    caplog: pytest.LogCaptureFixture,
+    caplog: pytest.LogCaptureFixture, component: str
 ) -> None:
-    """With the web_server component the plaintext /update endpoint is always
-    on; the combination validates with a warning."""
+    """web_server and prometheus keep the shared listener up, so the
+    plaintext /update endpoint is always on and the combination warns."""
     full_conf = {
-        "web_server": {},
+        component: {},
         CONF_OTA: [
             _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}}),
             {CONF_PLATFORM: "web_server", CONF_ID: ID("ota_ws", is_manual=False)},
@@ -316,12 +288,12 @@ def test_encryption_with_web_server_ota_warns(
         fv.full_config.reset(token)
 
 
-def test_encryption_with_captive_portal_web_server_ota_warns(
+def test_encryption_with_captive_portal_does_not_warn(
     caplog: pytest.LogCaptureFixture,
 ) -> None:
     """captive_portal auto-loads the web_server ota platform without the
-    web_server component; encryption stays usable and only warns, so the
-    fallback AP recovery path is not lost."""
+    web_server component; its endpoint only exists while the fallback AP is
+    active and is the intended recovery path, so there is no warning."""
     full_conf = {
         "captive_portal": {},
         CONF_OTA: [
@@ -333,7 +305,10 @@ def test_encryption_with_captive_portal_web_server_ota_warns(
     try:
         with caplog.at_level(logging.WARNING):
             ota_esphome_final_validate({})
-        assert any("captive_portal" in record.message for record in caplog.records)
+        assert not any(
+            "OTA encryption does not cover" in record.message
+            for record in caplog.records
+        )
         esphome_conf = next(
             conf
             for conf in fv.full_config.get()[CONF_OTA]
@@ -344,6 +319,100 @@ def test_encryption_with_captive_portal_web_server_ota_warns(
         fv.full_config.reset(token)
 
 
+def test_password_with_api_key_warns(caplog: pytest.LogCaptureFixture) -> None:
+    """A static api key makes the device offer encryption and the CLI take
+    it, so the password is dead weight; the config validates with a warning."""
+    full_conf = {
+        CONF_API: {CONF_ENCRYPTION: {CONF_KEY: API_KEY}},
+        CONF_OTA: [_make_ota_config(port=3232, **{CONF_PASSWORD: "pw"})],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert any("wastes significant flash" in r.message for r in caplog.records)
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_password_with_runtime_api_key_warns_differently(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """The CLI still needs the password, but the provisioned key also
+    authenticates uploads; the warning says so without the flash advice."""
+    full_conf = {
+        CONF_API: {CONF_ENCRYPTION: {}},
+        CONF_OTA: [_make_ota_config(port=3232, **{CONF_PASSWORD: "pw"})],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        messages = [r.message for r in caplog.records]
+        assert any("provisioned at runtime also authenticates" in m for m in messages)
+        assert not any("wastes significant flash" in m for m in messages)
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_password_without_api_key_no_warning(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """Without an api key there is no offer, so nothing to warn about."""
+    full_conf = {
+        CONF_API: {},
+        CONF_OTA: [_make_ota_config(port=3232, **{CONF_PASSWORD: "pw"})],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert not any("authenticates" in r.message for r in caplog.records)
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_web_server_component_without_ota_platform_does_not_warn(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """The web_server component alone has no /update endpoint."""
+    full_conf = {
+        "web_server": {},
+        CONF_OTA: [
+            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}})
+        ],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert not any(
+            "OTA encryption does not cover" in r.message for r in caplog.records
+        )
+    finally:
+        fv.full_config.reset(token)
+
+
+def test_web_server_ota_platform_alone_does_not_warn(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """Only the web_server component starts the shared listener, so the ota
+    platform on its own never exposes /update."""
+    full_conf = {
+        CONF_OTA: [
+            _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}}),
+            {CONF_PLATFORM: "web_server", CONF_ID: ID("ota_ws", is_manual=False)},
+        ],
+    }
+    token = fv.full_config.set(full_conf)
+    try:
+        with caplog.at_level(logging.WARNING):
+            ota_esphome_final_validate({})
+        assert not any("plaintext /update" in r.message for r in caplog.records)
+    finally:
+        fv.full_config.reset(token)
+
+
 def test_web_server_ota_without_encryption_unaffected() -> None:
     """web_server ota stays valid alongside an unencrypted esphome entry."""
     full_conf = {
@@ -370,20 +439,87 @@ def test_auto_load_pulls_noise_only_for_encryption() -> None:
     assert "noise" in AUTO_LOAD({})
 
 
-def test_filter_source_files_excludes_noise_without_encryption() -> None:
-    """The noise transport source compiles only for encrypted builds."""
-    old_config = CORE.config
-    try:
-        CORE.config = {CONF_OTA: [_make_ota_config(port=3232)]}
-        assert FILTER_SOURCE_FILES() == ["ota_esphome_noise.cpp"]
-        CORE.config = {
-            CONF_OTA: [
-                _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: API_KEY}})
-            ]
-        }
-        assert FILTER_SOURCE_FILES() == []
-    finally:
-        CORE.config = old_config
+def test_static_encryption_key() -> None:
+    """Only a build-time key counts; a runtime provisioned one does not."""
+    assert static_encryption_key({}) is None
+    assert static_encryption_key({CONF_ENCRYPTION: {}}) is None
+    assert static_encryption_key({CONF_ENCRYPTION: {CONF_KEY: API_KEY}}) == API_KEY
+
+
+@pytest.mark.parametrize(
+    ("yaml_name", "defines_present", "defines_absent"),
+    [
+        # An api key alone compiles the transport in without requiring it;
+        # the device uses the api server's key, not a copy
+        (
+            "api_key_offer",
+            {"USE_OTA_ENCRYPTION", "USE_OTA_ENCRYPTION_FROM_API"},
+            {"USE_OTA_ENCRYPTION_REQUIRED", "USE_OTA_ENCRYPTION_PROVISIONED"},
+        ),
+        # A password still guards plaintext uploads on an offering device
+        (
+            "api_key_offer_password",
+            {"USE_OTA_ENCRYPTION", "USE_OTA_ENCRYPTION_FROM_API", "USE_OTA_PASSWORD"},
+            {"USE_OTA_ENCRYPTION_REQUIRED", "USE_OTA_ENCRYPTION_PROVISIONED"},
+        ),
+        # The ota encryption block is what makes the device refuse plaintext
+        (
+            "encryption_required",
+            {
+                "USE_OTA_ENCRYPTION",
+                "USE_OTA_ENCRYPTION_REQUIRED",
+                "USE_OTA_ENCRYPTION_FROM_API",
+            },
+            {"USE_OTA_ENCRYPTION_PROVISIONED"},
+        ),
+        # Without api encryption the ota key is the device's own
+        (
+            "own_key",
+            {"USE_OTA_ENCRYPTION", "USE_OTA_ENCRYPTION_REQUIRED"},
+            {"USE_OTA_ENCRYPTION_FROM_API", "USE_OTA_ENCRYPTION_PROVISIONED"},
+        ),
+        # A key provisioned at runtime lives in the api server; the device
+        # offers with it once provisioned and never requires it
+        (
+            "runtime_api_key",
+            {
+                "USE_OTA_ENCRYPTION",
+                "USE_OTA_ENCRYPTION_FROM_API",
+                "USE_OTA_ENCRYPTION_PROVISIONED",
+            },
+            {"USE_OTA_ENCRYPTION_REQUIRED"},
+        ),
+        # No api encryption at all keeps the noise glue out of the build
+        (
+            "plain",
+            set(),
+            {
+                "USE_OTA_ENCRYPTION",
+                "USE_OTA_ENCRYPTION_REQUIRED",
+                "USE_OTA_ENCRYPTION_FROM_API",
+                "USE_OTA_ENCRYPTION_PROVISIONED",
+            },
+        ),
+    ],
+)
+def test_encryption_offer_codegen(
+    generate_main: Callable[[str], str],
+    yaml_name: str,
+    defines_present: set[str],
+    defines_absent: set[str],
+) -> None:
+    main_cpp = generate_main(
+        f"tests/component_tests/ota/test_esphome_ota_{yaml_name}.yaml"
+    )
+    defines = {define.name for define in CORE.defines}
+    assert defines_present <= defines
+    assert not (defines_absent & defines)
+    encrypted = "USE_OTA_ENCRYPTION" in defines_present
+    own_key = encrypted and "USE_OTA_ENCRYPTION_FROM_API" not in defines_present
+    assert ("esphome_esphomeotacomponent_id->set_noise_psk(" in main_cpp) is own_key
+    assert ("set_auth_password(" in main_cpp) is ("USE_OTA_PASSWORD" in defines_present)
+    # The noise transport source compiles only when the define is set
+    assert FILTER_SOURCE_FILES() == ([] if encrypted else ["ota_esphome_noise.cpp"])
 
 
 def test_password_with_encryption_rejected() -> None:

tests/component_tests/ota/test_esphome_ota_api_key_offer.yaml

@@ -0,0 +1,11 @@
+esphome:
+  name: ota-offer
+
+host:
+
+api:
+  encryption:
+    key: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+
+ota:
+  - platform: esphome

tests/component_tests/ota/test_esphome_ota_api_key_offer_password.yaml

@@ -0,0 +1,12 @@
+esphome:
+  name: ota-offer-password
+
+host:
+
+api:
+  encryption:
+    key: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+
+ota:
+  - platform: esphome
+    password: "superlongpasswordthatnoonewillknow"

tests/component_tests/ota/test_esphome_ota_encryption_required.yaml

@@ -0,0 +1,12 @@
+esphome:
+  name: ota-encryption-required
+
+host:
+
+api:
+  encryption:
+    key: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+
+ota:
+  - platform: esphome
+    encryption:

tests/component_tests/ota/test_esphome_ota_own_key.yaml

@@ -0,0 +1,11 @@
+esphome:
+  name: ota-own-key
+
+host:
+
+api:
+
+ota:
+  - platform: esphome
+    encryption:
+      key: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="

tests/component_tests/ota/test_esphome_ota_plain.yaml

@@ -0,0 +1,9 @@
+esphome:
+  name: ota-plain
+
+host:
+
+api:
+
+ota:
+  - platform: esphome

tests/component_tests/ota/test_esphome_ota_runtime_api_key.yaml

@@ -0,0 +1,10 @@
+esphome:
+  name: ota-runtime-key
+
+host:
+
+api:
+  encryption:
+
+ota:
+  - platform: esphome

tests/components/noise/test_noise_handshake.cpp

@@ -68,6 +68,14 @@ class Initiator {
 
 static const uint8_t PROLOGUE[] = {'t', 'e', 's', 't', 'p', 'r', 'o', 'l', 'o', 'g', 'u', 'e'};
 
+// The context only points at the key and init() copies it before returning,
+// so a temporary context over a temporary key is safe within one call
+static NoiseContext ctx_for(const psk_t &psk) {
+  NoiseContext ctx;
+  ctx.set_psk(psk.data());
+  return ctx;
+}
+
 static psk_t make_psk(uint8_t seed) {
   psk_t psk;
   for (size_t i = 0; i < psk.size(); i++) {
@@ -102,7 +110,7 @@ TEST(NoiseResponderHandshakeTest, MessageMethodsErrorBeforeInit) {
 TEST(NoiseResponderHandshakeTest, FullHandshakeAndTransportRoundTrip) {
   const psk_t psk = make_psk(7);
   NoiseResponderHandshake responder;
-  ASSERT_EQ(responder.init(psk, PROLOGUE, sizeof(PROLOGUE)), 0);
+  ASSERT_EQ(responder.init(ctx_for(psk), PROLOGUE, sizeof(PROLOGUE)), 0);
   EXPECT_EQ(responder.action(), Action::ACTION_READ);
 
   Initiator initiator(psk, PROLOGUE, sizeof(PROLOGUE));
@@ -155,8 +163,8 @@ TEST(NoiseResponderHandshakeTest, ReInitRestartsHandshake) {
   // proves the restart took effect; the old state surviving would fail the
   // MAC here.
   NoiseResponderHandshake responder;
-  ASSERT_EQ(responder.init(make_psk(7), PROLOGUE, sizeof(PROLOGUE)), 0);
-  ASSERT_EQ(responder.init(make_psk(9), PROLOGUE, sizeof(PROLOGUE)), 0);
+  ASSERT_EQ(responder.init(ctx_for(make_psk(7)), PROLOGUE, sizeof(PROLOGUE)), 0);
+  ASSERT_EQ(responder.init(ctx_for(make_psk(9)), PROLOGUE, sizeof(PROLOGUE)), 0);
   EXPECT_EQ(responder.action(), Action::ACTION_READ);
 
   Initiator initiator(make_psk(9), PROLOGUE, sizeof(PROLOGUE));
@@ -168,7 +176,7 @@ TEST(NoiseResponderHandshakeTest, ReInitRestartsHandshake) {
 
 TEST(NoiseResponderHandshakeTest, WrongPskFailsWithMacFailure) {
   NoiseResponderHandshake responder;
-  ASSERT_EQ(responder.init(make_psk(7), PROLOGUE, sizeof(PROLOGUE)), 0);
+  ASSERT_EQ(responder.init(ctx_for(make_psk(7)), PROLOGUE, sizeof(PROLOGUE)), 0);
 
   Initiator initiator(make_psk(200), PROLOGUE, sizeof(PROLOGUE));
   uint8_t msg[MAX_HANDSHAKE_SIZE];
@@ -185,7 +193,7 @@ TEST(NoiseResponderHandshakeTest, MismatchedPrologueFailsWithMacFailure) {
   // tampered preamble must fail even with the right key.
   const psk_t psk = make_psk(7);
   NoiseResponderHandshake responder;
-  ASSERT_EQ(responder.init(psk, PROLOGUE, sizeof(PROLOGUE)), 0);
+  ASSERT_EQ(responder.init(ctx_for(psk), PROLOGUE, sizeof(PROLOGUE)), 0);
 
   static const uint8_t TAMPERED[] = {'x'};
   Initiator initiator(psk, TAMPERED, sizeof(TAMPERED));

tests/components/noise/test_noise_primitives.cpp

@@ -17,12 +17,17 @@ TEST(NoiseContextTest, AllZerosPskIsReserved) {
   EXPECT_FALSE(NoiseContext::is_all_zeros(psk));
 
   NoiseContext ctx;
+  psk_t loaded;
   EXPECT_FALSE(ctx.has_psk());
-  ctx.set_psk(zeros);
-  EXPECT_FALSE(ctx.has_psk());
-  ctx.set_psk(psk);
+  ctx.load_psk(loaded);
+  EXPECT_EQ(loaded, zeros);
+  ctx.set_psk(psk.data());
   EXPECT_TRUE(ctx.has_psk());
-  EXPECT_EQ(ctx.get_psk(), psk);
+  ctx.load_psk(loaded);
+  EXPECT_EQ(loaded, psk);
+  // Callers map the reserved key to nullptr; the context just stores what it is given
+  ctx.set_psk(nullptr);
+  EXPECT_FALSE(ctx.has_psk());
 }
 
 TEST(WireFormatTest, FrameHeaderIsIndicatorPlusBigEndianLength) {

tests/components/ota/api_key_offer.yaml

@@ -0,0 +1,12 @@
+wifi:
+  ssid: MySSID
+  password: password1
+
+api:
+  encryption:
+    key: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+
+ota:
+  - platform: esphome
+    port: 3290
+    password: "superlongpasswordthatnoonewillknow"

tests/components/ota/api_runtime_key.yaml

@@ -0,0 +1,10 @@
+wifi:
+  ssid: MySSID
+  password: password1
+
+api:
+  encryption:
+
+ota:
+  - platform: esphome
+    port: 3291

tests/components/ota/test-api_key_offer.esp32-idf.yaml

@@ -0,0 +1,2 @@
+packages:
+  ota: !include api_key_offer.yaml

tests/components/ota/test-api_key_offer.esp8266-ard.yaml

@@ -0,0 +1,2 @@
+packages:
+  ota: !include api_key_offer.yaml

tests/components/ota/test-api_runtime_key.esp32-idf.yaml

@@ -0,0 +1,2 @@
+packages:
+  ota: !include api_runtime_key.yaml

tests/components/ota/test-api_runtime_key.esp8266-ard.yaml

@@ -0,0 +1,2 @@
+packages:
+  ota: !include api_runtime_key.yaml

tests/components/wifi/common.yaml

@@ -14,6 +14,7 @@ esphome:
           condition: wifi.ap_active
           then:
             - logger.log: "WiFi AP is active!"
+      - wifi.roam
 
 wifi:
   networks:

tests/integration/conftest.py

@@ -162,6 +162,13 @@ def integration_test_dir() -> Generator[Path]:
         yield Path(tmpdir)
 
 
+@pytest.fixture
+def isolated_preferences(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    """Host preferences persist per device name; give the test its own so a
+    provisioned key never leaks into another run."""
+    monkeypatch.setenv("ESPHOME_PREFDIR", str(tmp_path / "prefs"))
+
+
 @pytest.fixture
 def reserved_tcp_port() -> Generator[tuple[int, socket.socket]]:
     """Reserve an unused TCP port by holding the socket open."""

tests/integration/const.py

@@ -9,6 +9,13 @@ API_CONNECTION_TIMEOUT = 30.0  # seconds
 PORT_WAIT_TIMEOUT = 30.0  # seconds
 PORT_POLL_INTERVAL = 0.1  # seconds
 
+# The well-known all-zeros provisioning PSK, a key to provision over it, and
+# the time the device takes to activate a newly saved key (100 ms timer plus
+# margin)
+ZERO_PSK = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+PROVISIONING_PSK = b"bm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm5ubm4="
+KEY_ACTIVATION_DELAY = 0.5  # seconds
+
 # Process shutdown timeouts
 SIGINT_TIMEOUT = 5.0  # seconds
 SIGTERM_TIMEOUT = 2.0  # seconds

tests/integration/fixtures/host_ota_api_key_offer_with_password.yaml

@@ -0,0 +1,12 @@
+esphome:
+  name: host-ota-test
+host:
+api:
+  encryption:
+    key: "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+ota:
+  - platform: esphome
+    port: __OTA_PORT__
+    password: "hunter2"
+logger:
+  level: DEBUG

tests/integration/fixtures/host_ota_provisioned_api_key.yaml

@@ -0,0 +1,10 @@
+esphome:
+  name: host-ota-test
+host:
+api:
+  encryption:
+ota:
+  - platform: esphome
+    port: __OTA_PORT__
+logger:
+  level: DEBUG

tests/integration/test_api_zero_psk_provisioning.py

@@ -10,34 +10,40 @@ from __future__ import annotations
 
 import asyncio
 import base64
+import socket
 
 from aioesphomeapi import InvalidEncryptionKeyAPIError, RequiresEncryptionAPIError
 import pytest
 
-from .types import APIClientConnectedFactory, RunCompiledFunction
+from .conftest import run_binary_and_wait_for_port
+from .const import KEY_ACTIVATION_DELAY, LOCALHOST, PROVISIONING_PSK, ZERO_PSK
+from .types import (
+    APIClientConnectedFactory,
+    CompileFunction,
+    ConfigWriter,
+    RunCompiledFunction,
+)
 
-# The well-known provisioning PSK: base64 of 32 zero bytes
-ZERO_PSK = base64.b64encode(bytes(32)).decode()
-# A real key to provision
-NEW_KEY = base64.b64encode(b"n" * 32)
-# Time for the device to activate a newly saved key (100ms timer plus margin)
-KEY_ACTIVATION_DELAY = 0.5
-
-
-@pytest.fixture(autouse=True)
-def isolated_preferences(monkeypatch: pytest.MonkeyPatch, tmp_path) -> None:
-    """Keep host preferences per-test so every run starts unprovisioned."""
-    monkeypatch.setenv("ESPHOME_PREFDIR", str(tmp_path / "prefs"))
+pytestmark = pytest.mark.usefixtures("isolated_preferences")
+NEW_KEY = PROVISIONING_PSK
 
 
 @pytest.mark.asyncio
 async def test_api_zero_psk_provisioning(
     yaml_config: str,
-    run_compiled: RunCompiledFunction,
+    write_yaml_config: ConfigWriter,
+    compile_esphome: CompileFunction,
+    reserved_tcp_port: tuple[int, socket.socket],
     api_client_connected: APIClientConnectedFactory,
 ) -> None:
-    """Exercise the reject paths, then provision a key over the zero-PSK channel."""
-    async with run_compiled(yaml_config):
+    """Exercise the reject paths, provision a key over the zero-PSK channel,
+    and check the key comes back from preferences on the next boot."""
+    port, port_socket = reserved_tcp_port
+    config_path = await write_yaml_config(yaml_config)
+    binary_path = await compile_esphome(config_path)
+    port_socket.close()
+
+    async with run_binary_and_wait_for_port(binary_path, LOCALHOST, port):
         # --- Pre-provisioning reject paths (device state is unchanged) ---
 
         # A wrong (non-zero) PSK fails against the zero provisioning PSK
@@ -97,6 +103,19 @@ async def test_api_zero_psk_provisioning(
             async with api_client_connected(timeout=5) as client:
                 await client.device_info()
 
+    # The key is loaded from preferences on the next boot
+    lines: list[str] = []
+    async with run_binary_and_wait_for_port(
+        binary_path, LOCALHOST, port, line_callback=lines.append
+    ):
+        async with api_client_connected(noise_psk=NEW_KEY.decode()) as client:
+            device_info = await client.device_info()
+            assert device_info.api_encryption_provisionable is False
+        with pytest.raises(InvalidEncryptionKeyAPIError):
+            async with api_client_connected(noise_psk=ZERO_PSK, timeout=5) as client:
+                await client.device_info()
+    assert any("Loaded saved Noise PSK" in line for line in lines)
+
 
 @pytest.mark.asyncio
 async def test_api_zero_psk_provisioning_plaintext(

tests/integration/test_host_ota.py

@@ -8,9 +8,12 @@ instance covers the FD_CLOEXEC path.
 from __future__ import annotations
 
 import asyncio
+import base64
 from collections.abc import Generator
 from contextlib import contextmanager
+from dataclasses import dataclass
 import functools
+from pathlib import Path
 import socket
 
 import pytest
@@ -18,10 +21,18 @@ import pytest
 from esphome import espota2
 
 from .conftest import run_binary, wait_and_connect_api_client
-from .const import LOCALHOST, PORT_POLL_INTERVAL, PORT_WAIT_TIMEOUT
-from .types import CompileFunction, ConfigWriter
+from .const import (
+    KEY_ACTIVATION_DELAY,
+    LOCALHOST,
+    PORT_POLL_INTERVAL,
+    PORT_WAIT_TIMEOUT,
+    PROVISIONING_PSK,
+    ZERO_PSK,
+)
+from .types import APIClientConnectedFactory, CompileFunction, ConfigWriter
 
 DEVICE_NAME = "host-ota-test"
+API_KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
 
 
 @contextmanager
@@ -35,6 +46,14 @@ def _reserve_port() -> Generator[tuple[int, socket.socket]]:
         s.close()
 
 
+async def _wait_for_line(lines: list[str], needle: str, timeout: float = 5.0) -> None:
+    """The config dump prints after every setup, a little after the api port
+    opens, so wait for it rather than assert on the lines seen so far."""
+    async with asyncio.timeout(timeout):
+        while not any(needle in line for line in lines):
+            await asyncio.sleep(PORT_POLL_INTERVAL)
+
+
 async def _wait_for_port(host: str, port: int, timeout: float) -> None:
     """Poll until a TCP port accepts connections, or raise TimeoutError."""
     loop = asyncio.get_running_loop()
@@ -51,6 +70,102 @@ async def _wait_for_port(host: str, port: int, timeout: float) -> None:
     raise TimeoutError(f"Port {port} on {host} did not open within {timeout}s")
 
 
+async def _build(
+    yaml_config: str,
+    write_yaml_config: ConfigWriter,
+    compile_esphome: CompileFunction,
+    reserved_tcp_port: tuple[int, socket.socket],
+) -> tuple[int, int, Path]:
+    """Reserve an OTA port, compile the fixture with it, and release both
+    ports right before the binary is started."""
+    api_port, api_socket = reserved_tcp_port
+    with _reserve_port() as (ota_port, ota_socket):
+        config_path = await write_yaml_config(
+            yaml_config.replace("__OTA_PORT__", str(ota_port))
+        )
+        binary_path = await compile_esphome(config_path)
+        api_socket.close()
+        ota_socket.close()
+    return api_port, ota_port, binary_path
+
+
+async def _run_ota(
+    ota_port: int,
+    password: str | None,
+    binary_path: Path,
+    noise_psk: str | None,
+    plaintext_fallback: bool = False,
+) -> int:
+    """espota2 is blocking; run it in the executor and return its exit code."""
+    rc, _ = await asyncio.get_running_loop().run_in_executor(
+        None,
+        functools.partial(
+            espota2.run_ota,
+            LOCALHOST,
+            ota_port,
+            password,
+            binary_path,
+            noise_psk=noise_psk,
+            plaintext_fallback=plaintext_fallback,
+        ),
+    )
+    return rc
+
+
+@dataclass
+class _Device:
+    """A running host binary and the checks every successful OTA repeats:
+    a safe reboot, the api port back up, and the pid preserved by execv."""
+
+    api_port: int
+    ota_port: int
+    binary_path: Path
+    proc: asyncio.subprocess.Process | None = None
+    reboots: int = 0
+
+    def __post_init__(self) -> None:
+        self._rebooted = asyncio.Event()
+
+    def on_log(self, line: str) -> None:
+        if "Rebooting safely" in line:
+            self.reboots += 1
+            self._rebooted.set()
+
+    async def wait_reboot(self, count: int, timeout: float = 10.0) -> None:
+        async with asyncio.timeout(timeout):
+            while self.reboots < count:
+                self._rebooted.clear()
+                await self._rebooted.wait()
+
+    async def ota(
+        self,
+        password: str | None,
+        noise_psk: str | None,
+        msg: str,
+        plaintext_fallback: bool = False,
+    ) -> None:
+        """Upload, then expect the re-exec with the pid preserved."""
+        pid_before = self.proc.pid
+        expected_reboots = self.reboots + 1
+        rc = await _run_ota(
+            self.ota_port, password, self.binary_path, noise_psk, plaintext_fallback
+        )
+        assert rc == 0, msg
+        await self.wait_reboot(expected_reboots)
+        await _wait_for_port(LOCALHOST, self.api_port, PORT_WAIT_TIMEOUT)
+        assert self.proc.returncode is None, "process exited instead of execing"
+        assert self.proc.pid == pid_before
+
+    async def refused_ota(
+        self, password: str | None, noise_psk: str | None, msg: str
+    ) -> None:
+        """Upload must fail and the device must keep running."""
+        rc = await _run_ota(self.ota_port, password, self.binary_path, noise_psk)
+        assert rc == 1, msg
+        await asyncio.sleep(0.5)
+        assert self.proc.returncode is None, "process died on rejected OTA"
+
+
 @pytest.mark.asyncio
 async def test_host_ota_self_update(
     yaml_config: str,
@@ -59,57 +174,34 @@ async def test_host_ota_self_update(
     reserved_tcp_port: tuple[int, socket.socket],
 ) -> None:
     """Self-OTA: upload the running binary back to itself, expect re-exec."""
-    api_port, api_socket = reserved_tcp_port
-    with _reserve_port() as (ota_port, ota_socket):
-        yaml_config = yaml_config.replace("__OTA_PORT__", str(ota_port))
-        config_path = await write_yaml_config(yaml_config)
-        binary_path = await compile_esphome(config_path)
-        api_socket.close()
-        ota_socket.close()
+    dev = _Device(
+        *await _build(
+            yaml_config, write_yaml_config, compile_esphome, reserved_tcp_port
+        )
+    )
+    staged = asyncio.Event()
 
-        loop = asyncio.get_running_loop()
-        ota_staged = loop.create_future()
-        rebooted = loop.create_future()
+    def on_log(line: str) -> None:
+        if "OTA staged at" in line:
+            staged.set()
+        dev.on_log(line)
 
-        def on_log(line: str) -> None:
-            if not ota_staged.done() and "OTA staged at" in line:
-                ota_staged.set_result(True)
-            if not rebooted.done() and "Rebooting safely" in line:
-                rebooted.set_result(True)
+    async with run_binary(dev.binary_path, line_callback=on_log) as (proc, _lines):
+        dev.proc = proc
+        await _wait_for_port(LOCALHOST, dev.api_port, PORT_WAIT_TIMEOUT)
+        async with wait_and_connect_api_client(port=dev.api_port) as client:
+            info_before = await client.device_info()
+            assert info_before.name == DEVICE_NAME
 
-        async with run_binary(binary_path, line_callback=on_log) as (proc, _lines):
-            await _wait_for_port(LOCALHOST, api_port, PORT_WAIT_TIMEOUT)
-            pid_before = proc.pid
-            async with wait_and_connect_api_client(port=api_port) as client:
-                info_before = await client.device_info()
-                assert info_before.name == DEVICE_NAME
+        await dev.ota(None, None, "espota2 reported failure")
+        assert staged.is_set()
 
-            # espota2 is blocking; run in executor.
-            rc, _ = await loop.run_in_executor(
-                None, espota2.run_ota, LOCALHOST, ota_port, None, binary_path
-            )
-            assert rc == 0, "espota2 reported failure"
+        async with wait_and_connect_api_client(port=dev.api_port) as client:
+            info_after = await client.device_info()
+            assert info_after.name == info_before.name
 
-            await asyncio.wait_for(ota_staged, timeout=10.0)
-            await asyncio.wait_for(rebooted, timeout=10.0)
-            await _wait_for_port(LOCALHOST, api_port, PORT_WAIT_TIMEOUT)
-
-            # execv preserves pid; mismatch means external respawn.
-            assert proc.returncode is None, "process exited instead of execing"
-            assert proc.pid == pid_before
-
-            async with wait_and_connect_api_client(port=api_port) as client:
-                info_after = await client.device_info()
-                assert info_after.name == DEVICE_NAME
-                assert info_after.name == info_before.name
-
-            # Second OTA: catches FD_CLOEXEC regressions (EADDRINUSE on rebind).
-            rc, _ = await loop.run_in_executor(
-                None, espota2.run_ota, LOCALHOST, ota_port, None, binary_path
-            )
-            assert rc == 0, "second OTA failed -- listener leaked across execv"
-            await _wait_for_port(LOCALHOST, api_port, PORT_WAIT_TIMEOUT)
-            assert proc.pid == pid_before
+        # Second OTA: catches FD_CLOEXEC regressions (EADDRINUSE on rebind).
+        await dev.ota(None, None, "second OTA failed -- listener leaked across execv")
 
 
 @pytest.mark.asyncio
@@ -121,51 +213,110 @@ async def test_host_ota_encrypted(
 ) -> None:
     """Encrypted self-OTA succeeds; a plaintext upload to the same device fails."""
     pytest.importorskip("aioesphomeapi.noise")
-    noise_psk = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
-    api_port, api_socket = reserved_tcp_port
-    with _reserve_port() as (ota_port, ota_socket):
-        yaml_config = yaml_config.replace("__OTA_PORT__", str(ota_port))
-        config_path = await write_yaml_config(yaml_config)
-        binary_path = await compile_esphome(config_path)
-        api_socket.close()
-        ota_socket.close()
+    dev = _Device(
+        *await _build(
+            yaml_config, write_yaml_config, compile_esphome, reserved_tcp_port
+        )
+    )
+    async with run_binary(dev.binary_path, line_callback=dev.on_log) as (proc, _lines):
+        dev.proc = proc
+        await _wait_for_port(LOCALHOST, dev.api_port, PORT_WAIT_TIMEOUT)
+        await dev.refused_ota(
+            None, None, "plaintext upload to an encrypted device must fail"
+        )
+        await dev.ota(None, API_KEY, "encrypted OTA reported failure")
 
-        loop = asyncio.get_running_loop()
-        rebooted = loop.create_future()
 
-        def on_log(line: str) -> None:
-            if not rebooted.done() and "Rebooting safely" in line:
-                rebooted.set_result(True)
+@pytest.mark.asyncio
+async def test_host_ota_api_key_offer_with_password(
+    yaml_config: str,
+    write_yaml_config: ConfigWriter,
+    compile_esphome: CompileFunction,
+    reserved_tcp_port: tuple[int, socket.socket],
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    """With only an api key the device offers encryption without requiring
+    it: the password still guards plaintext uploads, the key alone
+    authenticates an encrypted one, and until 2027.3.0 a failed encrypted
+    attempt falls back to plaintext."""
+    pytest.importorskip("aioesphomeapi.noise")
+    wrong_key = base64.b64encode(b"w" * 32).decode()
+    dev = _Device(
+        *await _build(
+            yaml_config, write_yaml_config, compile_esphome, reserved_tcp_port
+        )
+    )
+    async with run_binary(dev.binary_path, line_callback=dev.on_log) as (proc, lines):
+        dev.proc = proc
+        await _wait_for_port(LOCALHOST, dev.api_port, PORT_WAIT_TIMEOUT)
+        await _wait_for_line(lines, "Encryption: offered")
 
-        async with run_binary(binary_path, line_callback=on_log) as (proc, _lines):
-            await _wait_for_port(LOCALHOST, api_port, PORT_WAIT_TIMEOUT)
-            pid_before = proc.pid
+        await dev.refused_ota(
+            None, None, "plaintext upload without the password must fail"
+        )
+        await dev.ota(
+            "hunter2", None, "plaintext upload with the password must succeed"
+        )
+        await dev.ota(None, API_KEY, "encrypted upload with the api key must succeed")
 
-            # A plaintext upload must be refused with the device unharmed
-            rc, _ = await loop.run_in_executor(
-                None, espota2.run_ota, LOCALHOST, ota_port, None, binary_path
+        # Remove before 2027.3.0: a wrong key falls back to plaintext, which
+        # the password still guards
+        with caplog.at_level("WARNING", logger="esphome.espota2"):
+            await dev.ota(
+                "hunter2",
+                wrong_key,
+                "the plaintext retry with the password must succeed",
+                plaintext_fallback=True,
             )
-            assert rc == 1, "plaintext upload to an encrypted device must fail"
-            await asyncio.sleep(0.5)
-            assert proc.returncode is None, "process died on rejected plaintext OTA"
+        assert any("Retrying in plaintext" in r.message for r in caplog.records)
+        await dev.ota(
+            None,
+            API_KEY,
+            "the right api key encrypts without touching the fallback",
+            plaintext_fallback=True,
+        )
 
-            # The encrypted upload goes through and the device re-execs
-            rc, _ = await loop.run_in_executor(
-                None,
-                functools.partial(
-                    espota2.run_ota,
-                    LOCALHOST,
-                    ota_port,
-                    None,
-                    binary_path,
-                    noise_psk=noise_psk,
-                ),
-            )
-            assert rc == 0, "encrypted OTA reported failure"
-            await asyncio.wait_for(rebooted, timeout=10.0)
-            await _wait_for_port(LOCALHOST, api_port, PORT_WAIT_TIMEOUT)
-            assert proc.returncode is None, "process exited instead of execing"
-            assert proc.pid == pid_before
+
+@pytest.mark.asyncio
+@pytest.mark.usefixtures("isolated_preferences")
+async def test_host_ota_provisioned_api_key(
+    yaml_config: str,
+    write_yaml_config: ConfigWriter,
+    compile_esphome: CompileFunction,
+    reserved_tcp_port: tuple[int, socket.socket],
+    api_client_connected: APIClientConnectedFactory,
+) -> None:
+    """A key provisioned over the api feeds the OTA offer: plaintext works
+    while unprovisioned, the provisioned key encrypts, the key loaded from
+    preferences on the next boot keeps encrypting, and plaintext stays
+    accepted because only the ota block requires encryption."""
+    pytest.importorskip("aioesphomeapi.noise")
+    dev = _Device(
+        *await _build(
+            yaml_config, write_yaml_config, compile_esphome, reserved_tcp_port
+        )
+    )
+    async with run_binary(dev.binary_path, line_callback=dev.on_log) as (proc, lines):
+        dev.proc = proc
+        await _wait_for_port(LOCALHOST, dev.api_port, PORT_WAIT_TIMEOUT)
+        await _wait_for_line(lines, "once the api key is provisioned")
+
+        await dev.ota(
+            None, None, "plaintext upload to an unprovisioned device must succeed"
+        )
+
+        async with api_client_connected(
+            port=dev.api_port, noise_psk=ZERO_PSK
+        ) as client:
+            assert await client.noise_encryption_set_key(PROVISIONING_PSK) is True
+        await asyncio.sleep(KEY_ACTIVATION_DELAY)
+
+        key = PROVISIONING_PSK.decode()
+        await dev.ota(
+            None, key, "encrypted upload with the provisioned key must succeed"
+        )
+        await dev.ota(None, key, "the key loaded at boot must feed the OTA offer")
+        await dev.ota(None, None, "plaintext must stay accepted on an offering device")
 
 
 @pytest.mark.asyncio
@@ -177,33 +328,25 @@ async def test_host_ota_rejects_garbage(
     integration_test_dir,
 ) -> None:
     """Bogus payload is rejected and the device keeps running."""
-    api_port, api_socket = reserved_tcp_port
-    with _reserve_port() as (ota_port, ota_socket):
-        yaml_config = yaml_config.replace("__OTA_PORT__", str(ota_port))
-        config_path = await write_yaml_config(yaml_config)
-        binary_path = await compile_esphome(config_path)
+    dev = _Device(
+        *await _build(
+            yaml_config, write_yaml_config, compile_esphome, reserved_tcp_port
+        )
+    )
+    # 192 bytes that are neither ELF nor Mach-O.
+    bogus_path = integration_test_dir / "bogus.bin"
+    bogus_path.write_bytes(b"NOT-AN-EXECUTABLE-AT-ALL" * 8)
 
-        # 192 bytes that are neither ELF nor Mach-O.
-        bogus_path = integration_test_dir / "bogus.bin"
-        bogus_path.write_bytes(b"NOT-AN-EXECUTABLE-AT-ALL" * 8)
+    async with run_binary(dev.binary_path) as (proc, _lines):
+        dev.proc = proc
+        await _wait_for_port(LOCALHOST, dev.api_port, PORT_WAIT_TIMEOUT)
+        pid_before = proc.pid
+        rc = await _run_ota(dev.ota_port, None, bogus_path, None)
+        assert rc == 1
+        await asyncio.sleep(0.5)
+        assert proc.returncode is None, "process died on rejected OTA"
+        assert proc.pid == pid_before
 
-        api_socket.close()
-        ota_socket.close()
-
-        async with run_binary(binary_path) as (proc, _lines):
-            await _wait_for_port(LOCALHOST, api_port, PORT_WAIT_TIMEOUT)
-            pid_before = proc.pid
-
-            loop = asyncio.get_running_loop()
-            rc, _ = await loop.run_in_executor(
-                None, espota2.run_ota, LOCALHOST, ota_port, None, bogus_path
-            )
-            assert rc == 1
-
-            await asyncio.sleep(0.5)
-            assert proc.returncode is None, "process died on rejected OTA"
-            assert proc.pid == pid_before
-
-            async with wait_and_connect_api_client(port=api_port) as client:
-                info = await client.device_info()
-                assert info.name == DEVICE_NAME
+        async with wait_and_connect_api_client(port=dev.api_port) as client:
+            info = await client.device_info()
+            assert info.name == DEVICE_NAME

tests/script/test_determine_jobs.py

@@ -78,17 +78,6 @@ def mock_esp32_platformio_components_to_test() -> Generator[Mock, None, None]:
         yield mock
 
 
-@pytest.fixture
-def mock_esp8266_native_components_to_test() -> Generator[Mock, None, None]:
-    """Mock esp8266_native_components_to_test from determine_jobs.
-
-    main() drives both the ``esp8266_native`` boolean output and the
-    ``esp8266_native_components`` CSV from this one function.
-    """
-    with patch.object(determine_jobs, "esp8266_native_components_to_test") as mock:
-        yield mock
-
-
 @pytest.fixture
 def mock_determine_cpp_unit_tests() -> Generator[Mock, None, None]:
     """Mock determine_cpp_unit_tests from helpers."""
@@ -117,7 +106,6 @@ def clear_determine_jobs_caches() -> None:
     """Clear all cached functions before each test."""
     determine_jobs._is_clang_tidy_full_scan.cache_clear()
     determine_jobs._component_has_tests.cache_clear()
-    determine_jobs._cached_components_closure.cache_clear()
 
 
 def test_main_all_tests_should_run(
@@ -128,7 +116,6 @@ def test_main_all_tests_should_run(
     mock_should_run_import_time: Mock,
     mock_should_run_device_builder: Mock,
     mock_esp32_platformio_components_to_test: Mock,
-    mock_esp8266_native_components_to_test: Mock,
     mock_changed_files: Mock,
     mock_determine_cpp_unit_tests: Mock,
     capsys: pytest.CaptureFixture[str],
@@ -145,7 +132,6 @@ def test_main_all_tests_should_run(
     mock_should_run_import_time.return_value = True
     mock_should_run_device_builder.return_value = True
     mock_esp32_platformio_components_to_test.return_value = ["api", "esp32"]
-    mock_esp8266_native_components_to_test.return_value = ["api", "logger"]
     mock_determine_cpp_unit_tests.return_value = (False, ["wifi", "api", "sensor"])
 
     # Mock changed_files to return non-component files (to avoid memory impact)
@@ -222,8 +208,6 @@ def test_main_all_tests_should_run(
     assert output["device_builder"] is True
     assert output["esp32_platformio"] is True
     assert output["esp32_platformio_components"] == "api,esp32"
-    assert output["esp8266_native"] is True
-    assert output["esp8266_native_components"] == "api,logger"
     assert output["changed_components"] == ["wifi", "api", "sensor"]
     # changed_components_with_tests will only include components that actually have test files
     assert "changed_components_with_tests" in output
@@ -260,7 +244,6 @@ def test_main_no_tests_should_run(
     mock_should_run_import_time: Mock,
     mock_should_run_device_builder: Mock,
     mock_esp32_platformio_components_to_test: Mock,
-    mock_esp8266_native_components_to_test: Mock,
     mock_changed_files: Mock,
     mock_determine_cpp_unit_tests: Mock,
     capsys: pytest.CaptureFixture[str],
@@ -277,7 +260,6 @@ def test_main_no_tests_should_run(
     mock_should_run_import_time.return_value = False
     mock_should_run_device_builder.return_value = False
     mock_esp32_platformio_components_to_test.return_value = []
-    mock_esp8266_native_components_to_test.return_value = []
     mock_determine_cpp_unit_tests.return_value = (False, [])
 
     # Mock changed_files to return no component files
@@ -320,8 +302,6 @@ def test_main_no_tests_should_run(
     assert output["device_builder"] is False
     assert output["esp32_platformio"] is False
     assert output["esp32_platformio_components"] == ""
-    assert output["esp8266_native"] is False
-    assert output["esp8266_native_components"] == ""
     assert output["changed_components"] == []
     assert output["changed_components_with_tests"] == []
     assert output["component_test_count"] == 0
@@ -3171,78 +3151,6 @@ def test_memory_impact_elf_layouts_are_found(tmp_path: Path) -> None:
         assert find_elf_path(build_path) == elf, f"{platform} ELF not found"
 
 
-@pytest.mark.parametrize(
-    "changed",
-    [
-        "esphome/arduino8266/framework.py",
-        "esphome/build_gen/arduino8266.py",
-        "esphome/components/esp8266/build_surgery.py",
-        # Shared modules the native build depends on
-        "esphome/build_helpers/idedata.py",
-        "esphome/platformio/library.py",
-        # Top-level esphome/*.py modules the backend imports directly
-        "esphome/framework_helpers.py",
-        "esphome/writer.py",
-        # esp8266/__init__.py imports copy_ccache_script from it
-        "esphome/platformio/toolchain.py",
-        # The composite cache action must not ship unexercised
-        ".github/actions/cache-arduino8266/action.yml",
-    ],
-)
-def test_esp8266_native_components_full_list_on_infra_change(changed: str) -> None:
-    """Native-ESP8266 infrastructure changes run the full test list."""
-    with (
-        patch.object(determine_jobs, "changed_files", return_value=[changed]),
-        patch.object(
-            determine_jobs,
-            "get_components_with_dependencies",
-            return_value=["wifi"],
-        ),
-    ):
-        result = determine_jobs.esp8266_native_components_to_test()
-        assert result == sorted(determine_jobs.ESP8266_NATIVE_TEST_COMPONENTS)
-
-
-@pytest.mark.parametrize(
-    ("changed_files", "dependency_closure", "expected"),
-    [
-        # Tested component changed -- narrow to the intersection.
-        (
-            ["esphome/components/mqtt/mqtt_client.cpp"],
-            ["mqtt", "json"],
-            ["mqtt"],
-        ),
-        # Components outside the test set return an empty list (job skipped).
-        (
-            ["esphome/components/wifi/wifi_component.cpp"],
-            ["wifi", "network"],
-            [],
-        ),
-        # espidf infrastructure is not an esp8266-native trigger; the
-        # native backend depends on esphome/build_helpers/ instead.
-        (["esphome/build_gen/espidf.py"], [], []),
-        (["esphome/espidf/toolchain.py"], [], []),
-        (["README.md"], [], []),
-    ],
-)
-def test_esp8266_native_components_to_test_narrowing(
-    changed_files: list[str],
-    dependency_closure: list[str],
-    expected: list[str],
-) -> None:
-    """Component changes narrow the native-ESP8266 test list."""
-    with (
-        patch.object(determine_jobs, "changed_files", return_value=changed_files),
-        patch.object(
-            determine_jobs,
-            "get_components_with_dependencies",
-            return_value=dependency_closure,
-        ),
-    ):
-        result = determine_jobs.esp8266_native_components_to_test()
-        assert result == expected
-
-
 def test_compute_integration_test_buckets_no_durations_full_fanout() -> None:
     """Without recorded durations the fan-out stays at the maximum."""
     files = [f"tests/integration/test_{i:03d}.py" for i in range(15)]

tests/script/test_test_build_components.py

@@ -236,98 +236,3 @@ def test_run_grouped_test_closes_group_when_subprocess_raises(
         )
 
     assert "::endgroup::" in capsys.readouterr().out
-
-
-def test_components_empty_match_fails_with_flag(
-    capsys: pytest.CaptureFixture[str],
-) -> None:
-    """Under --fail-on-no-tests, a real component filtered to a platform
-    with no matching test file must not pass CI as a green zero-component
-    compile."""
-    rc = tbc.test_components(
-        ["logger"],
-        "zz-none",
-        "compile",
-        False,
-        enable_grouping=False,
-        fail_on_no_tests=True,
-    )
-    assert rc == 1
-    assert "No tests ran for requested pattern(s): logger" in (capsys.readouterr().out)
-
-
-def test_components_component_with_no_base_file_fails_with_flag(
-    capsys: pytest.CaptureFixture[str],
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """A component whose fixture matches the platform but whose platform has
-    no base file builds nothing; under the flag that silent zero fails by
-    component name instead of hiding behind other components."""
-    monkeypatch.setattr(tbc, "get_platform_base_files", lambda base_dir: {})
-    rc = tbc.test_components(
-        ["logger"],
-        "esp8266-ard",
-        "compile",
-        False,
-        enable_grouping=False,
-        fail_on_no_tests=True,
-    )
-    assert rc == 1
-    assert "No tests ran for requested pattern(s): logger" in (capsys.readouterr().out)
-
-
-def test_components_blank_list_fails_with_flag(
-    capsys: pytest.CaptureFixture[str],
-) -> None:
-    """A fully blank component list must not slide into the baseline
-    fallback and exit green under the flag."""
-    rc = tbc.test_components(
-        [""], "esp8266-ard", "compile", False, fail_on_no_tests=True
-    )
-    assert rc == 1
-    assert "blank component list" in capsys.readouterr().out
-
-
-def test_components_wildcard_no_match_fails_with_flag(
-    capsys: pytest.CaptureFixture[str],
-) -> None:
-    """A wildcard matching nothing must not degrade to the synthetic
-    baseline build and exit green under the flag."""
-    rc = tbc.test_components(
-        ["zz_no_such*"],
-        "esp8266-ard",
-        "compile",
-        False,
-        enable_grouping=False,
-        fail_on_no_tests=True,
-    )
-    assert rc == 1
-    assert "No components found matching" in capsys.readouterr().out
-
-
-def test_components_empty_match_tolerated_without_flag() -> None:
-    """The esp32-ard smoke leg deliberately builds only the subset with a
-    matching fixture; without the flag an empty match stays green."""
-    assert (
-        tbc.test_components(
-            ["logger"], "zz-none", "compile", False, enable_grouping=False
-        )
-        == 0
-    )
-
-
-def test_components_unknown_component_fails_with_flag(
-    capsys: pytest.CaptureFixture[str],
-) -> None:
-    """A renamed smoke-test component must shrink coverage loudly, not fall
-    into the reference-baseline build."""
-    rc = tbc.test_components(
-        ["no_such_component_xyz"],
-        "esp8266-ard",
-        "compile",
-        False,
-        enable_grouping=False,
-        fail_on_no_tests=True,
-    )
-    assert rc == 1
-    assert "No components found matching" in capsys.readouterr().out

tests/unit_tests/build_gen/test_build_tool.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import os
 from pathlib import Path
 import subprocess
 import sys
@@ -245,20 +244,3 @@ def test_copy_failure_leaves_no_partial_output(tmp_path: Path) -> None:
     ):
         assert build_tool.main() == 1
     assert not dst.exists()
-
-
-def test_touch_creates_and_updates_stamp(tmp_path: Path) -> None:
-    stamp = tmp_path / "esphome_pch.probe"
-    assert build_tool._run_touch(str(stamp)) == 0
-    assert stamp.is_file()
-    os.utime(stamp, (1, 1))
-    assert build_tool._run_touch(str(stamp)) == 0
-    assert stamp.stat().st_mtime > 1
-
-
-def test_touch_reports_failure(
-    tmp_path: Path, capsys: pytest.CaptureFixture[str]
-) -> None:
-    missing_dir = tmp_path / "gone" / "stamp"
-    assert build_tool._run_touch(str(missing_dir)) == 1
-    assert "touch:" in capsys.readouterr().err

tests/unit_tests/build_gen/test_espidf.py

@@ -4,9 +4,7 @@ from __future__ import annotations
 
 import json
 import logging
-import os
 from pathlib import Path
-import subprocess
 from unittest.mock import patch
 
 import pytest
@@ -490,922 +488,3 @@ def test_get_component_cmakelists_no_compile_features() -> None:
         content = get_component_cmakelists()
 
     assert "target_compile_features" not in content
-
-
-@pytest.fixture(autouse=True)
-def _pch_default_on(monkeypatch: pytest.MonkeyPatch) -> None:
-    """Pin the knob so a developer's ESPHOME_PCH_ENABLE=0 cannot fail these."""
-    monkeypatch.setenv("ESPHOME_PCH_ENABLE", "1")
-
-
-def _make_pch_device(tmp_path: Path, name: str) -> Path:
-    """A device dir with the pch source headers and a stub compile_commands."""
-    from esphome.build_helpers.pch import PCH_DEFAULT_HEADERS
-
-    dev = tmp_path / name
-    for header in PCH_DEFAULT_HEADERS:
-        path = dev / "src" / header
-        path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_text("")
-    # A real quoted include chain and a per-device-named sdkconfig with
-    # identical content: the closure and sdkconfig inputs must be exercised
-    (dev / "src" / "esphome" / "core" / "defines.h").write_text(
-        '#include "esphome/core/macros.h"\n'
-    )
-    (dev / "src" / "esphome" / "core" / "macros.h").write_text("#define M 1\n")
-    # Both spellings: tests patch CORE.name to "test" or to the device name
-    (dev / f"sdkconfig.{name}").write_text("CONFIG_X=y\n")
-    (dev / "sdkconfig.test").write_text("CONFIG_X=y\n")
-    build = dev / "build"
-    build.mkdir(exist_ok=True)
-    from esphome.build_helpers.pch import pch_header_text
-
-    (build / "esphome_pch.h").write_text(pch_header_text(PCH_DEFAULT_HEADERS))
-    # Native separators: mixed f-string paths break the src-prefix match
-    # on Windows
-    src_file = str(dev / "src" / "a.cpp")
-    (build / "compile_commands.json").write_text(
-        json.dumps(
-            [
-                {
-                    "directory": str(build),
-                    "command": (
-                        "g++ -DX=1 -include esphome_pch.h "
-                        "-o esp-idf/src/CMakeFiles/__idf_src.dir/a.cpp.obj "
-                        f'-c "{src_file}"'
-                    ),
-                    "file": src_file,
-                }
-            ]
-        )
-    )
-    return dev
-
-
-def test_prepare_pch_writes_header_and_sum(tmp_path: Path) -> None:
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_a")
-    CORE.build_path = dev
-    gch = dev / "build" / "esphome_pch.h.gch"
-
-    def fake_compile(cmd, **kwargs):
-        if "-fsyntax-only" in cmd:
-            # The load probe follows a successful .gch build
-            return subprocess.CompletedProcess(cmd, 0, "", "")
-        # The compile must target the header, not the stub TU
-        assert cmd[-5:-3] == ["c++-header", "-c"]
-        gch.write_bytes(b"gch")
-        return subprocess.CompletedProcess(cmd, 0, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=fake_compile),
-    ):
-        prepare_pch()
-    checksum = (dev / "build" / "esphome_pch.h.gch.sum").read_text().strip()
-    assert len(checksum) == 64
-    # Unchanged inputs: the second call must not recompile
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=AssertionError),
-    ):
-        prepare_pch()
-
-
-def test_pch_no_device_path_poison(tmp_path: Path) -> None:
-    """Regression: neither the injected -include nor the .sum may carry the
-    per-device build path, or cross-device ccache sharing breaks."""
-    from esphome.build_gen.espidf import get_component_cmakelists, prepare_pch
-
-    sums = []
-    for name in ("dev_a", "dev_b"):
-        dev = _make_pch_device(tmp_path, name)
-        CORE.build_path = dev
-        gch = dev / "build" / "esphome_pch.h.gch"
-
-        def fake_compile(cmd, _gch=gch, **kwargs):
-            _gch.write_bytes(b"gch")
-            return subprocess.CompletedProcess(cmd, 0, "", "")
-
-        with (
-            patch.object(CORE, "name", name),
-            patch("esphome.build_helpers.pch.subprocess.run", side_effect=fake_compile),
-        ):
-            prepare_pch()
-            content = get_component_cmakelists()
-        assert str(dev) not in content
-        sums.append((dev / "build" / "esphome_pch.h.gch.sum").read_text())
-    assert sums[0] == sums[1]
-
-
-def test_component_cmakelists_pch_block(monkeypatch: pytest.MonkeyPatch) -> None:
-    from esphome.build_gen.espidf import get_component_cmakelists
-
-    content = get_component_cmakelists()
-    assert '"$<$<COMPILE_LANGUAGE:CXX>:-include>"' in content
-    assert "-Wno-error=invalid-pch" in content
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "1")
-    strict_content = get_component_cmakelists()
-    assert "-Werror=invalid-pch" in strict_content
-    monkeypatch.delenv("ESPHOME_PCH_STRICT")
-    assert '"$<$<COMPILE_LANGUAGE:CXX>:esphome_pch.h>"' in content
-    monkeypatch.setenv("ESPHOME_PCH_ENABLE", "0")
-    assert "-include" not in get_component_cmakelists()
-
-
-def test_pch_compile_command_variants(tmp_path: Path) -> None:
-    """Missing DB, no matching entry, and launcher-prefixed commands."""
-    from esphome.build_helpers.pch import pch_compile_command
-
-    build = tmp_path / "build"
-    build.mkdir()
-    header = build / "esphome_pch.h"
-    gch = build / "esphome_pch.h.gch"
-    assert pch_compile_command(build, header, gch) is None
-
-    (build / "compile_commands.json").write_text(
-        json.dumps(
-            [
-                {"command": "gcc -c other.c", "file": "other.c"},
-            ]
-        )
-    )
-    assert pch_compile_command(build, header, gch) is None
-
-    src_file = str(tmp_path / "src" / "esphome" / "a.cpp")
-    (build / "compile_commands.json").write_text(
-        json.dumps(
-            [
-                {
-                    "command": (
-                        "/usr/bin/ccache g++ -DX=1 -include esphome_pch.h -MMD "
-                        "-MT a.cpp.obj -MF a.cpp.obj.d "
-                        "-o esp-idf/src/CMakeFiles/__idf_src.dir/a.cpp.obj "
-                        f"-c {src_file}"
-                    ),
-                    "file": src_file,
-                },
-            ]
-        )
-    )
-    # Launcher stripped; -include/-o/-c and depfile flags removed
-    cmd, cmd_dir = pch_compile_command(build, header, gch)
-    assert cmd == [
-        "g++",
-        "-DX=1",
-        "-x",
-        "c++-header",
-        "-c",
-        str(header),
-        "-o",
-        str(gch),
-    ]
-    # The compile must run where the flags were resolved
-    assert cmd_dir == build
-
-
-@pytest.mark.skipif(os.name == "nt", reason="symlinks need privileges on Windows")
-def test_pch_compile_command_matches_src_through_symlink(tmp_path: Path) -> None:
-    """Find the src TU when CMake spells paths through a different symlink (macOS /tmp)."""
-    from esphome.build_helpers.pch import pch_compile_command
-
-    real = tmp_path / "real"
-    (real / "src" / "esphome").mkdir(parents=True)
-    link = tmp_path / "link"
-    link.symlink_to(real, target_is_directory=True)
-    CORE.build_path = str(real)
-    build = real / "build"
-    build.mkdir()
-    header = build / "esphome_pch.h"
-    gch = build / "esphome_pch.h.gch"
-    src_file = str(link / "src" / "esphome" / "a.cpp")
-    (build / "compile_commands.json").write_text(
-        json.dumps([{"command": f"g++ -DX=1 -o a.obj -c {src_file}", "file": src_file}])
-    )
-
-    cmd, cmd_dir = pch_compile_command(build, header, gch)
-
-    assert cmd[:2] == ["g++", "-DX=1"]
-    assert cmd_dir == build
-
-
-def test_pch_compile_command_rejects_unusable_entries(tmp_path: Path) -> None:
-    """Malformed DB shapes and command-less entries skip cleanly instead of
-    producing a compiler-less argv retried every build."""
-    from esphome.build_helpers.pch import pch_compile_command
-
-    build = tmp_path / "build"
-    build.mkdir()
-    header = build / "esphome_pch.h"
-    gch = build / "esphome_pch.h.gch"
-    db = build / "compile_commands.json"
-    src_file = str(tmp_path / "src" / "esphome" / "a.cpp")
-
-    db.write_text(json.dumps({"not": "a list"}))
-    assert pch_compile_command(build, header, gch) is None
-
-    db.write_text(json.dumps(["just a string"]))
-    assert pch_compile_command(build, header, gch) is None
-
-    # An empty-string directory must fall back to the build dir, not cwd
-    db.write_text(
-        json.dumps(
-            [
-                {
-                    "directory": "",
-                    "command": f"g++ -DX=1 -o a.obj -c {src_file}",
-                    "file": src_file,
-                }
-            ]
-        )
-    )
-    _, cmd_dir = pch_compile_command(build, header, gch)
-    assert cmd_dir == build
-
-    # Corrupted entries with null fields must skip, not raise
-    db.write_text(
-        json.dumps(
-            [
-                {"file": None, "command": "g++ -c x.cpp", "directory": None},
-                {"file": src_file, "command": None, "directory": None},
-            ]
-        )
-    )
-    assert pch_compile_command(build, header, gch) is None
-
-    # arguments-style entry (allowed by the spec, unused by CMake)
-    db.write_text(
-        json.dumps([{"arguments": ["g++", "-c", src_file], "file": src_file}])
-    )
-    assert pch_compile_command(build, header, gch) is None
-
-
-def test_pch_header_list_order_is_in_checksum(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """Reordering PCH_DEFAULT_HEADERS keeps the include closure identical, but the
-    generated header text differs, so the .gch must rebuild."""
-    import esphome.build_gen.espidf as espidf_mod
-
-    dev = _make_pch_device(tmp_path, "dev_r")
-    CORE.build_path = dev
-    gch = dev / "build" / "esphome_pch.h.gch"
-
-    def fake_compile(cmd, **kwargs):
-        gch.write_bytes(b"gch")
-        return subprocess.CompletedProcess(cmd, 0, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=fake_compile),
-    ):
-        espidf_mod.prepare_pch()
-        first = (dev / "build" / "esphome_pch.h.gch.sum").read_text()
-        monkeypatch.setattr(
-            espidf_mod,
-            "PCH_DEFAULT_HEADERS",
-            tuple(reversed(espidf_mod.PCH_DEFAULT_HEADERS)),
-        )
-        espidf_mod.prepare_pch()
-    assert (dev / "build" / "esphome_pch.h.gch.sum").read_text() != first
-
-
-def test_prepare_pch_failure_writes_marker_and_skips_retry(tmp_path: Path) -> None:
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_f")
-    CORE.build_path = dev
-    calls = []
-
-    def failing_compile(cmd, **kwargs):
-        calls.append(cmd)
-        return subprocess.CompletedProcess(cmd, 1, "", "boom")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=failing_compile),
-    ):
-        prepare_pch()
-        prepare_pch()
-    assert len(calls) == 1
-    assert not (dev / "build" / "esphome_pch.h.gch.sum").exists()
-    assert (dev / "build" / "esphome_pch.h.gch.failed").exists()
-
-
-def test_prepare_pch_spawn_oserror_is_transient(tmp_path: Path) -> None:
-    """Spawn/IO failures retry on the next build instead of latching."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_o")
-    CORE.build_path = dev
-    calls = []
-
-    def raising(cmd, **kwargs):
-        calls.append(cmd)
-        raise OSError("no such compiler")
-
-    header = dev / "build" / "esphome_pch.h"
-    before = header.stat().st_mtime_ns
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=raising),
-    ):
-        prepare_pch()
-        prepare_pch()
-    assert not (dev / "build" / "esphome_pch.h.gch.failed").exists()
-    assert not (dev / "build" / "esphome_pch.h.gch.sum").exists()
-    assert len(calls) == 2
-    # No .gch was ever in play, so the header must not be re-touched into
-    # forcing a full rebuild on every failing build
-    assert header.stat().st_mtime_ns == before
-
-
-def test_prepare_pch_transient_with_stale_gch_bumps_header(tmp_path: Path) -> None:
-    """A stale .gch removed on a transient failure must dirty its consumers."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_s")
-    CORE.build_path = dev
-    gch = dev / "build" / "esphome_pch.h.gch"
-    gch.write_bytes(b"stale")
-    header = dev / "build" / "esphome_pch.h"
-    os.utime(header, (1, 1))
-    with (
-        patch.object(CORE, "name", "test"),
-        patch(
-            "esphome.build_helpers.pch.subprocess.run",
-            side_effect=OSError("no such compiler"),
-        ),
-    ):
-        prepare_pch()
-    assert not gch.exists()
-    assert header.stat().st_mtime_ns > 1_000_000_000
-
-
-def test_prepare_pch_disabled_discards_and_skips_compile(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """The escape hatch is self-cleaning: a leftover .gch is removed."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    monkeypatch.setenv("ESPHOME_PCH_ENABLE", "0")
-    dev = _make_pch_device(tmp_path, "dev_d")
-    CORE.build_path = dev
-    stale = dev / "build" / "esphome_pch.h.gch"
-    stale.write_bytes(b"stale")
-    with patch("esphome.build_helpers.pch.subprocess.run", side_effect=AssertionError):
-        prepare_pch()
-    assert not stale.exists()
-
-
-def test_prepare_pch_missing_sdkconfig_fails_closed(tmp_path: Path) -> None:
-    """No sdkconfig means no config identity for the .sum: no pch at all."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_m")
-    (dev / "sdkconfig.test").unlink()
-    CORE.build_path = dev
-    stale = dev / "build" / "esphome_pch.h.gch"
-    stale.write_bytes(b"stale")
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=AssertionError),
-    ):
-        prepare_pch()
-    assert not stale.exists()
-    assert not (dev / "build" / "esphome_pch.h.gch.sum").exists()
-
-
-def test_prepare_pch_signal_kill_is_transient(tmp_path: Path) -> None:
-    """A signal-killed compile (OOM) must not latch the .failed marker."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_k")
-    CORE.build_path = dev
-    calls = []
-
-    def killed(cmd, **kwargs):
-        calls.append(cmd)
-        return subprocess.CompletedProcess(cmd, -9, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=killed),
-    ):
-        prepare_pch()
-        prepare_pch()
-    assert not (dev / "build" / "esphome_pch.h.gch.failed").exists()
-    assert len(calls) == 2
-
-
-def test_prepare_pch_probe_spawn_failure_degrades(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """A probe that cannot run discards the pch; strict raises."""
-    from esphome.build_gen.espidf import prepare_pch
-    from esphome.core import EsphomeError
-
-    dev = _make_pch_device(tmp_path, "dev_pf")
-    CORE.build_path = dev
-    gch = dev / "build" / "esphome_pch.h.gch"
-
-    def probe_dies(cmd, **kwargs):
-        if "-fsyntax-only" in cmd:
-            raise OSError("probe spawn failed")
-        gch.write_bytes(b"gch")
-        return subprocess.CompletedProcess(cmd, 0, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=probe_dies),
-    ):
-        prepare_pch()
-    assert not gch.exists()
-    assert not (dev / "build" / "esphome_pch.h.gch.sum").exists()
-
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "1")
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=probe_dies),
-        pytest.raises(EsphomeError, match="probe did not run"),
-    ):
-        prepare_pch()
-
-
-@pytest.mark.parametrize(
-    ("stderr", "code"),
-    [("", -9), ("fatal: No space left on device", 1)],
-    ids=("signal-kill", "enospc"),
-)
-def test_prepare_pch_probe_environmental_failures_do_not_latch(
-    tmp_path: Path, stderr: str, code: int
-) -> None:
-    """A signal-killed or ENOSPC probe retries next build, no marker."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_pe")
-    CORE.build_path = dev
-    gch = dev / "build" / "esphome_pch.h.gch"
-
-    def env_probe(cmd, **kwargs):
-        if "-fsyntax-only" in cmd:
-            return subprocess.CompletedProcess(cmd, code, "", stderr)
-        gch.write_bytes(b"gch")
-        return subprocess.CompletedProcess(cmd, 0, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=env_probe),
-    ):
-        prepare_pch()
-    assert not gch.exists()
-    assert not (dev / "build" / "esphome_pch.h.gch.failed").exists()
-
-
-def test_prepare_pch_signal_kill_strict_raises(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    from esphome.build_gen.espidf import prepare_pch
-    from esphome.core import EsphomeError
-
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "1")
-    dev = _make_pch_device(tmp_path, "dev_ks")
-    CORE.build_path = dev
-    with (
-        patch.object(CORE, "name", "test"),
-        patch(
-            "esphome.build_helpers.pch.subprocess.run",
-            side_effect=lambda cmd, **kw: subprocess.CompletedProcess(cmd, -9, "", ""),
-        ),
-        pytest.raises(EsphomeError, match="killed by signal"),
-    ):
-        prepare_pch()
-
-
-def test_prepare_pch_strict_raises_when_disabled(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """Strict must not read a disabled pch as success."""
-    from esphome.build_gen.espidf import prepare_pch
-    from esphome.core import EsphomeError
-
-    monkeypatch.setenv("ESPHOME_PCH_ENABLE", "0")
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "1")
-    dev = _make_pch_device(tmp_path, "dev_ds")
-    CORE.build_path = dev
-    with (
-        patch.object(CORE, "name", "test"),
-        pytest.raises(EsphomeError, match="disabled"),
-    ):
-        prepare_pch()
-
-
-def test_prepare_pch_missing_sdkconfig_strict_raises(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    from esphome.build_gen.espidf import prepare_pch
-    from esphome.core import EsphomeError
-
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "1")
-    dev = _make_pch_device(tmp_path, "dev_ss")
-    (dev / "sdkconfig.test").unlink()
-    CORE.build_path = dev
-    with (
-        patch.object(CORE, "name", "test"),
-        pytest.raises(EsphomeError, match="sdkconfig unreadable"),
-    ):
-        prepare_pch()
-
-
-def test_prepare_pch_without_compile_commands(tmp_path: Path) -> None:
-    """Stale checksum but no configured TU yet: no compile, no sidecars."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_n")
-    (dev / "build" / "compile_commands.json").unlink()
-    CORE.build_path = dev
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=AssertionError),
-    ):
-        prepare_pch()
-    assert not (dev / "build" / "esphome_pch.h.gch.sum").exists()
-    assert not (dev / "build" / "esphome_pch.h.gch.failed").exists()
-
-
-def test_write_project_pch_disabled_writes_no_header(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    from esphome.build_gen.espidf import write_project
-
-    monkeypatch.setenv("ESPHOME_PCH_ENABLE", "0")
-    _write_project_description(tmp_path, {})
-    CORE.build_path = tmp_path
-    with (
-        patch("esphome.build_gen.espidf.get_esp32_variant", return_value="ESP32"),
-        patch.object(CORE, "name", "test"),
-    ):
-        write_project()
-    assert not (tmp_path / "build" / "esphome_pch.h").exists()
-
-
-def test_write_project_writes_pch_header(tmp_path: Path) -> None:
-    """The header write_project emits is what _pch_cmake() force-includes;
-    this pairing is the one non-fail-safe path in the design."""
-    from esphome.build_gen.espidf import write_project
-    from esphome.build_helpers.pch import PCH_DEFAULT_HEADERS, pch_header_text
-
-    _write_project_description(tmp_path, {})
-    CORE.build_path = tmp_path
-    with (
-        patch("esphome.build_gen.espidf.get_esp32_variant", return_value="ESP32"),
-        patch.object(CORE, "name", "test"),
-    ):
-        write_project()
-    assert (tmp_path / "build" / "esphome_pch.h").read_text() == pch_header_text(
-        PCH_DEFAULT_HEADERS
-    )
-
-
-def test_prepare_pch_stale_bailout_removes_gch(tmp_path: Path) -> None:
-    """A stale .gch must not survive when no compile command is available."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_s")
-    CORE.build_path = dev
-    gch = dev / "build" / "esphome_pch.h.gch"
-    gch.write_bytes(b"stale")
-    (dev / "build" / "esphome_pch.h.gch.sum").write_text("stale-sum\n")
-    (dev / "build" / "compile_commands.json").unlink()
-    with patch.object(CORE, "name", "test"):
-        prepare_pch()
-    assert not gch.exists()
-    assert not (dev / "build" / "esphome_pch.h.gch.sum").exists()
-
-
-def test_prepare_pch_zero_exit_without_gch_is_failure(tmp_path: Path) -> None:
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_z")
-    CORE.build_path = dev
-
-    def no_output(cmd, **kwargs):
-        return subprocess.CompletedProcess(cmd, 0, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=no_output),
-    ):
-        prepare_pch()
-    assert not (dev / "build" / "esphome_pch.h.gch.sum").exists()
-    assert (dev / "build" / "esphome_pch.h.gch.failed").exists()
-
-
-def test_prepare_pch_bumps_header_for_object_depends(tmp_path: Path) -> None:
-    """The OBJECT_DEPENDS edge watches the header; a rebuilt .gch must bump
-    it so pch-consuming TUs recompile."""
-    import os as _os
-
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_t")
-    CORE.build_path = dev
-    header = dev / "build" / "esphome_pch.h"
-    gch = dev / "build" / "esphome_pch.h.gch"
-    _os.utime(header, (0, 0))
-    before = header.stat().st_mtime
-
-    def fake_compile(cmd, **kwargs):
-        gch.write_bytes(b"gch")
-        return subprocess.CompletedProcess(cmd, 0, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=fake_compile),
-    ):
-        prepare_pch()
-    assert header.stat().st_mtime > before
-
-
-def test_component_cmakelists_pch_object_depends() -> None:
-    from esphome.build_gen.espidf import get_component_cmakelists
-
-    content = get_component_cmakelists()
-    assert 'OBJECT_DEPENDS "${CMAKE_BINARY_DIR}/esphome_pch.h"' in content
-
-
-def test_prepare_pch_command_change_invalidates_sum(tmp_path: Path) -> None:
-    """A flag-only change in the compile DB must rebuild the .gch."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_c")
-    CORE.build_path = dev
-    gch = dev / "build" / "esphome_pch.h.gch"
-
-    def fake_compile(cmd, **kwargs):
-        gch.write_bytes(b"gch")
-        return subprocess.CompletedProcess(cmd, 0, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=fake_compile),
-    ):
-        prepare_pch()
-        first = (dev / "build" / "esphome_pch.h.gch.sum").read_text()
-        db = dev / "build" / "compile_commands.json"
-        db.write_text(db.read_text().replace("-DX=1", "-DX=2"))
-        prepare_pch()
-    assert (dev / "build" / "esphome_pch.h.gch.sum").read_text() != first
-
-
-def test_prepare_pch_keeps_user_force_includes(tmp_path: Path) -> None:
-    from esphome.build_helpers.pch import pch_compile_command
-
-    dev = _make_pch_device(tmp_path, "dev_u")
-    CORE.build_path = dev
-    build = dev / "build"
-    src_file = str(dev / "src" / "esphome" / "a.cpp")
-    build.joinpath("compile_commands.json").write_text(
-        json.dumps(
-            [
-                {
-                    "directory": str(build),
-                    "command": (
-                        "g++ -include user.h -include esphome_pch.h "
-                        f"-o a.obj -c {src_file}"
-                    ),
-                    "file": src_file,
-                }
-            ]
-        )
-    )
-    cmd, _ = pch_compile_command(build, build / "esphome_pch.h", build / "x.gch")
-    assert "user.h" in cmd
-    assert "esphome_pch.h" not in " ".join(cmd[:-3])
-
-
-def test_prepare_pch_identity_unknown_discards(tmp_path: Path) -> None:
-    """An OSError from the checksum discards artifacts and skips the pch."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_i")
-    CORE.build_path = dev
-    stale = dev / "build" / "esphome_pch.h.gch"
-    stale.write_bytes(b"stale")
-    with (
-        patch.object(CORE, "name", "test"),
-        patch(
-            "esphome.build_helpers.pch.pch_checksum",
-            side_effect=OSError("stat failed"),
-        ),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=AssertionError),
-    ):
-        prepare_pch()
-    assert not stale.exists()
-    assert not (dev / "build" / "esphome_pch.h.gch.sum").exists()
-
-
-def test_prepare_pch_transient_compiler_failure_does_not_latch(
-    tmp_path: Path,
-) -> None:
-    """ENOSPC-style failures clear on their own; no .failed marker."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_e")
-    CORE.build_path = dev
-    calls = []
-
-    def enospc(cmd, **kwargs):
-        calls.append(cmd)
-        return subprocess.CompletedProcess(
-            cmd, 1, "", "fatal error: No space left on device"
-        )
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=enospc),
-    ):
-        prepare_pch()
-        prepare_pch()
-    assert not (dev / "build" / "esphome_pch.h.gch.failed").exists()
-    assert len(calls) == 2
-
-
-def test_prepare_pch_strict_raises_on_missing_db(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """ESPHOME_PCH_STRICT turns the silent skip into a failure."""
-    from esphome.build_gen.espidf import prepare_pch
-    from esphome.core import EsphomeError
-
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "1")
-    dev = _make_pch_device(tmp_path, "dev_st")
-    (dev / "build" / "compile_commands.json").unlink()
-    CORE.build_path = dev
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=AssertionError),
-        pytest.raises(EsphomeError, match="no usable compile command"),
-    ):
-        prepare_pch()
-
-
-def test_prepare_pch_probe_rejection_latches_and_degrades(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """A toolchain that cannot load its own .gch discards it, latches the
-    marker, and fails strict mode."""
-    from esphome.build_gen.espidf import prepare_pch
-    from esphome.core import EsphomeError
-
-    dev = _make_pch_device(tmp_path, "dev_p")
-    CORE.build_path = dev
-    gch = dev / "build" / "esphome_pch.h.gch"
-
-    def rejecting(cmd, **kwargs):
-        if "-fsyntax-only" in cmd:
-            if "-include" not in cmd:
-                # Baseline without the pch passes: the pch is to blame
-                return subprocess.CompletedProcess(cmd, 0, "", "")
-            return subprocess.CompletedProcess(
-                cmd, 1, "", "error: esphome_pch.h.gch: had text segment "
-            )
-        gch.write_bytes(b"gch")
-        return subprocess.CompletedProcess(cmd, 0, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=rejecting),
-    ):
-        prepare_pch()
-    assert not gch.exists()
-    assert (dev / "build" / "esphome_pch.h.gch.failed").exists()
-
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "1")
-    (dev / "build" / "esphome_pch.h.gch.failed").unlink()
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=rejecting),
-        pytest.raises(EsphomeError, match="cannot load the pch"),
-    ):
-        prepare_pch()
-
-
-def test_prepare_pch_strict_reprobes_cached_gch(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """Rejection is per-process: strict must re-prove a cached .gch loads."""
-    from esphome.build_gen.espidf import prepare_pch
-    from esphome.core import EsphomeError
-
-    dev = _make_pch_device(tmp_path, "dev_rc")
-    CORE.build_path = dev
-    gch = dev / "build" / "esphome_pch.h.gch"
-
-    def ok(cmd, **kwargs):
-        if "-fsyntax-only" not in cmd:
-            gch.write_bytes(b"gch")
-        return subprocess.CompletedProcess(cmd, 0, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=ok),
-    ):
-        prepare_pch()
-    assert gch.exists()
-
-    def reject(cmd, **kwargs):
-        assert "-fsyntax-only" in cmd, "cached path must not recompile"
-        if "-include" not in cmd:
-            return subprocess.CompletedProcess(cmd, 0, "", "")
-        return subprocess.CompletedProcess(
-            cmd, 1, "", "error: esphome_pch.h.gch: had text segment "
-        )
-
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "1")
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=reject),
-        pytest.raises(EsphomeError, match="cannot load the pch"),
-    ):
-        prepare_pch()
-    assert not gch.exists()
-    # Per-process rejection may not reproduce: the cached path must not
-    # latch the pch off for later non-strict builds
-    assert not (dev / "build" / "esphome_pch.h.gch.failed").exists()
-
-
-def test_prepare_pch_unexpected_command_shape_degrades(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """A tail the probe slice cannot trust discards and degrades."""
-    from esphome.build_gen.espidf import prepare_pch
-    from esphome.core import EsphomeError
-
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "1")
-    dev = _make_pch_device(tmp_path, "dev_sh")
-    CORE.build_path = dev
-    gch = dev / "build" / "esphome_pch.h.gch"
-
-    def ok(cmd, **kwargs):
-        gch.write_bytes(b"gch")
-        return subprocess.CompletedProcess(cmd, 0, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=ok),
-        patch(
-            "esphome.build_helpers.pch.pch_compile_command",
-            return_value=(
-                ["g++", "-DX=1", "-c", "x", "-o", "y", "extra"],
-                dev / "build",
-            ),
-        ),
-        pytest.raises(EsphomeError, match="command shape"),
-    ):
-        prepare_pch()
-    assert not gch.exists()
-
-    # Non-strict: same shape problem degrades without raising
-    monkeypatch.delenv("ESPHOME_PCH_STRICT")
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=ok),
-        patch(
-            "esphome.build_helpers.pch.pch_compile_command",
-            return_value=(
-                ["g++", "-DX=1", "-c", "x", "-o", "y", "extra"],
-                dev / "build",
-            ),
-        ),
-    ):
-        prepare_pch()
-    assert not gch.exists()
-
-
-def test_prepare_pch_probe_baseline_spawn_failure_is_transient(
-    tmp_path: Path,
-) -> None:
-    """A baseline that cannot spawn is environmental: no marker."""
-    from esphome.build_gen.espidf import prepare_pch
-
-    dev = _make_pch_device(tmp_path, "dev_bs")
-    CORE.build_path = dev
-    gch = dev / "build" / "esphome_pch.h.gch"
-
-    def flaky(cmd, **kwargs):
-        if "-fsyntax-only" in cmd:
-            if "-include" in cmd:
-                return subprocess.CompletedProcess(cmd, 1, "", "boom")
-            raise OSError("baseline spawn failed")
-        gch.write_bytes(b"gch")
-        return subprocess.CompletedProcess(cmd, 0, "", "")
-
-    with (
-        patch.object(CORE, "name", "test"),
-        patch("esphome.build_helpers.pch.subprocess.run", side_effect=flaky),
-    ):
-        prepare_pch()
-    assert not gch.exists()
-    assert not (dev / "build" / "esphome_pch.h.gch.failed").exists()

tests/unit_tests/build_helpers/test_ccache.py

@@ -10,7 +10,6 @@ from unittest.mock import patch
 import pytest
 
 from esphome.build_helpers import ccache
-from esphome.core import CORE
 
 
 def test_resolve_opt_out() -> None:
@@ -121,17 +120,3 @@ def test_parse_enable_env_spelling_tables(
     """cv.boolean's spelling tables plus the 1/0 env convention."""
     monkeypatch.setenv("ESPHOME_CCACHE_ENABLE", raw)
     assert ccache.parse_enable_env("ESPHOME_CCACHE_ENABLE") is expected
-
-
-def test_effective_ccache_basedir_prefers_user_value(tmp_path: Path) -> None:
-    CORE.build_path = tmp_path
-    # Drive-qualified on Windows: "/custom/base" is not absolute there
-    base = "C:\\custom\\base" if os.name == "nt" else "/custom/base"
-    with patch.dict(os.environ, {"CCACHE_BASEDIR": base}, clear=True):
-        assert ccache.effective_ccache_basedir() == base
-    with patch.dict(os.environ, {}, clear=True):
-        assert ccache.effective_ccache_basedir() == str(tmp_path.resolve())
-    # Degenerate values would strip substrings ccache never rewrites
-    for bad in ("", "/", "a/b"):
-        with patch.dict(os.environ, {"CCACHE_BASEDIR": bad}, clear=True):
-            assert ccache.effective_ccache_basedir() == str(tmp_path.resolve())

tests/unit_tests/build_helpers/test_idedata.py

@@ -85,87 +85,6 @@ def test_parse_entry_resolves_relative_includes() -> None:
     assert all(Path(inc).is_absolute() for inc in includes)
 
 
-def test_parse_entry_resolves_force_include_path(tmp_path: Path) -> None:
-    """The pch -include is emitted relative to the build dir; idedata must
-    resolve it so cached flags work from any cwd."""
-    (tmp_path / "esphome_pch.h").write_text("")
-    entry = _entry(
-        str(tmp_path),
-        f"{tmp_path}/src/esphome/x.cpp",
-        "g++ -include esphome_pch.h -c x.cpp",
-    )
-
-    _, _, _, cxx_flags = idedata.parse_entry(entry)
-
-    idx = cxx_flags.index("-include")
-    resolved = cxx_flags[idx + 1]
-    assert Path(resolved).is_absolute()
-    assert resolved == str(tmp_path / "esphome_pch.h").replace("\\", "/")
-
-
-def test_parse_entry_resolves_joined_force_include(tmp_path: Path) -> None:
-    """The joined -includefoo.h spelling takes the same resolve path."""
-    (tmp_path / "esphome_pch.h").write_text("")
-    entry = _entry(
-        str(tmp_path),
-        f"{tmp_path}/src/esphome/x.cpp",
-        "g++ -includeesphome_pch.h -c x.cpp",
-    )
-
-    _, _, _, cxx_flags = idedata.parse_entry(entry)
-
-    resolved = cxx_flags[cxx_flags.index("-include") + 1]
-    assert resolved == str(tmp_path / "esphome_pch.h").replace("\\", "/")
-
-
-def test_parse_entry_keeps_search_chain_force_include(tmp_path: Path) -> None:
-    """-include names resolved via the -I chain (libretiny's Arduino.h) must
-    not be re-anchored to a nonexistent build-dir path."""
-    entry = _entry(
-        str(tmp_path),
-        f"{tmp_path}/src/esphome/x.cpp",
-        "g++ -include Arduino.h -c x.cpp",
-    )
-
-    _, _, _, cxx_flags = idedata.parse_entry(entry)
-
-    assert cxx_flags[cxx_flags.index("-include") + 1] == "Arduino.h"
-
-
-def test_parse_entry_warns_on_vanished_force_include(
-    tmp_path: Path, caplog: pytest.LogCaptureFixture
-) -> None:
-    """A build-dir force-include deleted by clean_build must leave a trail;
-    a name resolvable via the -I chain must not warn."""
-    inc = tmp_path / "inc"
-    inc.mkdir()
-    (inc / "Arduino.h").write_text("")
-    entry = _entry(
-        str(tmp_path),
-        f"{tmp_path}/src/esphome/x.cpp",
-        f"g++ -I{inc} -include Arduino.h -include esphome_pch.h -c x.cpp",
-    )
-
-    _, _, _, cxx_flags = idedata.parse_entry(entry)
-
-    assert "Arduino.h" in cxx_flags
-    assert "esphome_pch.h" in caplog.text
-    assert "Arduino.h" not in caplog.text
-
-
-def test_parse_entry_drops_trailing_force_include(
-    tmp_path: Path, caplog: pytest.LogCaptureFixture
-) -> None:
-    entry = _entry(
-        str(tmp_path), f"{tmp_path}/src/esphome/x.cpp", "g++ -c x.cpp -include"
-    )
-
-    _, _, _, cxx_flags = idedata.parse_entry(entry)
-
-    assert "-include" not in cxx_flags
-    assert "no argument" in caplog.text
-
-
 def test_parse_entry_skips_dependency_flags() -> None:
     """Dependency-generation flags (and their args) are dropped."""
     entry = _entry(
@@ -185,7 +104,7 @@ def test_expand_response_files(tmp_path: Path) -> None:
     rsp = tmp_path / "flags.rsp"
     rsp.write_text("-DFROM_RSP -I/rsp/inc")
 
-    tokens = idedata.expand_response_files(
+    tokens = idedata._expand_response_files(
         ["g++", f"@{rsp.name}", "-c", "x.cpp"], tmp_path
     )
 
@@ -196,7 +115,7 @@ def test_expand_response_files(tmp_path: Path) -> None:
 
 def test_expand_response_files_keeps_literal_when_missing(tmp_path: Path) -> None:
     """An unreadable ``@file`` token is kept verbatim rather than dropped."""
-    tokens = idedata.expand_response_files(["g++", "@nope.rsp"], tmp_path)
+    tokens = idedata._expand_response_files(["g++", "@nope.rsp"], tmp_path)
     assert "@nope.rsp" in tokens
 
 
@@ -408,7 +327,7 @@ def test_split_command_preserves_paths_and_unescapes_quotes() -> None:
     r"""Backslash paths survive while ``\"`` define-quoting is unescaped."""
     command = r"C:\esp\bin\riscv32-esp-elf-g++.exe -DVER=\"1.2.3\" -IC:/inc/a -c x.cpp"
 
-    tokens = idedata.split_command(command)
+    tokens = idedata._split_command(command)
 
     assert tokens[0] == r"C:\esp\bin\riscv32-esp-elf-g++.exe"
     assert '-DVER="1.2.3"' in tokens
@@ -422,8 +341,8 @@ def test_split_command_empty_returns_empty() -> None:
     Guards against ``CommandLineToArgvW("")`` returning the current process name
     instead of an empty list.
     """
-    assert idedata.split_command("") == []
-    assert idedata.split_command("   ") == []
+    assert idedata._split_command("") == []
+    assert idedata._split_command("   ") == []
 
 
 @pytest.mark.skipif(os.name != "nt", reason="Windows argv tokenization")
@@ -584,9 +503,9 @@ def test_load_or_build_idedata_rebuilds_non_dict_cache(tmp_path: Path) -> None:
 def test_is_launcher_matches_only_known_launchers() -> None:
     """Compilers of any shape pass; only the closed launcher set matches."""
     for token in ("/t/g++-13", "gcc-8.4.0", "clang++-17", "armcc", "icx", "cc"):
-        assert not idedata.is_launcher(token)
+        assert not idedata._is_launcher(token)
     for token in ("/opt/homebrew/bin/ccache", "CCACHE.EXE", "distcc", "sccache"):
-        assert idedata.is_launcher(token)
+        assert idedata._is_launcher(token)
 
 
 def test_load_or_build_idedata_corrupted_cache_is_logged(

tests/unit_tests/build_helpers/test_pch.py

@@ -1,336 +0,0 @@
-"""Tests for esphome.build_helpers.pch."""
-
-from __future__ import annotations
-
-import os
-from pathlib import Path
-from unittest.mock import patch
-
-import pytest
-
-from esphome.build_helpers import pch
-
-
-def _write(src_dir: Path, name: str, content: str) -> None:
-    path = src_dir / name
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text(content)
-
-
-@pytest.mark.parametrize(
-    ("value", "expected"),
-    [
-        (None, True),
-        ("1", True),
-        ("0", False),
-        ("false", False),
-        ("", False),
-    ],
-)
-def test_pch_enabled(value: str | None, expected: bool) -> None:
-    env = {} if value is None else {"ESPHOME_PCH_ENABLE": value}
-    with patch.dict(os.environ, env, clear=True):
-        assert pch.pch_enabled() is expected
-
-
-def test_ccache_pch_env_empty_until_emitted() -> None:
-    """No sloppiness relaxation for a build that skipped the pch."""
-    with patch.dict(os.environ, {}, clear=True):
-        assert pch.ccache_pch_env() == {}
-
-
-def test_ccache_pch_env_enabled() -> None:
-    pch.mark_pch_emitted()
-    with patch.dict(os.environ, {}, clear=True):
-        env = pch.ccache_pch_env()
-    assert env["CCACHE_SLOPPINESS"] == "pch_defines,time_macros"
-    assert env["CCACHE_PCH_EXTSUM"] == "true"
-
-
-def test_ccache_pch_env_disabled() -> None:
-    with patch.dict(os.environ, {"ESPHOME_PCH_ENABLE": "0"}, clear=True):
-        assert pch.ccache_pch_env() == {}
-
-
-def test_ccache_pch_env_token_check_is_membership_not_substring(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    """A token merely containing ours must not suppress the union."""
-    pch.mark_pch_emitted()
-    with patch.dict(os.environ, {"CCACHE_SLOPPINESS": "pch_defines_extra"}, clear=True):
-        env = pch.ccache_pch_env()
-    assert env["CCACHE_SLOPPINESS"] == "pch_defines_extra,pch_defines,time_macros"
-
-
-def test_ccache_pch_env_unions_user_sloppiness(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    """Without pch_defines/time_macros ccache declines every pch-consuming
-    compile, so missing tokens are unioned onto the user's value."""
-    pch.mark_pch_emitted()
-    with patch.dict(os.environ, {"CCACHE_SLOPPINESS": "locale"}, clear=True):
-        env = pch.ccache_pch_env()
-    assert env["CCACHE_SLOPPINESS"] == "locale,pch_defines,time_macros"
-    assert env["CCACHE_PCH_EXTSUM"] == "true"
-    assert "Adding pch_defines,time_macros" in caplog.text
-    caplog.clear()
-    with patch.dict(
-        os.environ, {"CCACHE_SLOPPINESS": "pch_defines,time_macros"}, clear=True
-    ):
-        env = pch.ccache_pch_env()
-    assert "CCACHE_SLOPPINESS" not in env
-    assert not caplog.records
-
-
-def test_pch_header_text_preserves_order() -> None:
-    text = pch.pch_header_text(["b.h", "a.h"])
-    assert text == '#include "b.h"\n#include "a.h"\n'
-
-
-def test_include_closure_resolves_relative_and_root(tmp_path: Path) -> None:
-    """Sibling includes resolve against the includer's directory first,
-    full paths against the src root; unresolvable names end the walk."""
-    _write(tmp_path, "esphome/components/x/a.h", '#include "b.h"\n')
-    _write(
-        tmp_path,
-        "esphome/components/x/b.h",
-        '#include "esphome/core/deep.h"\n#include <system.h>\n#include "missing.h"\n',
-    )
-    _write(tmp_path, "esphome/core/deep.h", "")
-    closure = pch._include_closure(tmp_path, ["esphome/components/x/a.h"])
-    assert sorted(closure) == [
-        "esphome/components/x/a.h",
-        "esphome/components/x/b.h",
-        "esphome/core/deep.h",
-    ]
-
-
-def test_include_closure_handles_cycles(tmp_path: Path) -> None:
-    _write(tmp_path, "a.h", '#include "b.h"\n')
-    _write(tmp_path, "b.h", '#include "a.h"\n')
-    assert sorted(pch._include_closure(tmp_path, ["a.h"])) == ["a.h", "b.h"]
-
-
-def test_include_closure_blocks_parent_escape(tmp_path: Path) -> None:
-    _write(tmp_path / "src", "a.h", '#include "../outside.h"\n')
-    (tmp_path / "outside.h").write_text("")
-    assert sorted(pch._include_closure(tmp_path / "src", ["a.h"])) == ["a.h"]
-
-
-def test_pch_checksum_tracks_closure_content(tmp_path: Path) -> None:
-    """A transitive header edit or an extra-identity change must change the
-    digest; unrelated files must not."""
-    _write(tmp_path, "root.h", '#include "nested.h"\n')
-    _write(tmp_path, "nested.h", "int a;\n")
-    _write(tmp_path, "unrelated.h", "int u;\n")
-    base = pch.pch_checksum(tmp_path, ["root.h"], ["id"])
-    assert base == pch.pch_checksum(tmp_path, ["root.h"], ["id"])
-    assert base != pch.pch_checksum(tmp_path, ["root.h"], ["other-id"])
-    _write(tmp_path, "unrelated.h", "int changed;\n")
-    assert base == pch.pch_checksum(tmp_path, ["root.h"], ["id"])
-    _write(tmp_path, "nested.h", "int b;\n")
-    assert base != pch.pch_checksum(tmp_path, ["root.h"], ["id"])
-
-
-@pytest.mark.skipif(
-    os.name == "nt" or os.geteuid() == 0, reason="chmod is ineffective here"
-)
-def test_include_closure_fails_closed_on_unreadable(
-    tmp_path: Path, caplog: pytest.LogCaptureFixture
-) -> None:
-    """A marker would truncate the transitive walk; the OSError propagates
-    so callers compile without a pch."""
-    _write(tmp_path, "a.h", '#include "locked.h"\n')
-    locked = tmp_path / "locked.h"
-    locked.write_text("")
-    locked.chmod(0)
-    try:
-        with pytest.raises(OSError):
-            pch._include_closure(tmp_path, ["a.h"])
-    finally:
-        locked.chmod(0o644)
-    assert "Could not read locked.h" in caplog.text
-
-
-def test_pch_extra_scripts_gated(monkeypatch: pytest.MonkeyPatch) -> None:
-    with patch.dict(os.environ, {}, clear=True):
-        assert pch.pch_extra_scripts() == ["post:pch.py"]
-    monkeypatch.setenv("ESPHOME_PCH_ENABLE", "0")
-    assert pch.pch_extra_scripts() == []
-
-
-def test_include_closure_raises_when_identity_unknown(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    """An unreadable header propagates; callers compile without a pch."""
-
-    class _BadFile:
-        def stat(self):  # noqa: ANN202 -- regular-file mode only
-            import os
-            import stat as stat_mod
-
-            return os.stat_result((stat_mod.S_IFREG | 0o644,) + (0,) * 9)
-
-        def read_bytes(self) -> bytes:
-            raise OSError("read failed")
-
-    class _FakeSrcDir:
-        def __truediv__(self, rel: str) -> _BadFile:
-            return _BadFile()
-
-    with pytest.raises(OSError, match="read failed"):
-        pch._include_closure(_FakeSrcDir(), ["a.h"])
-    assert "Could not read a.h" in caplog.text
-
-
-def test_include_closure_survives_non_utf8_include_name(tmp_path: Path) -> None:
-    """A non-UTF-8 quoted include must not abort the build; it simply does
-    not resolve and ends the walk."""
-    (tmp_path / "a.h").write_bytes(b'#include "bad\xff.h"\n#include "b.h"\n')
-    (tmp_path / "b.h").write_text("")
-    closure = pch._include_closure(tmp_path, ["a.h"])
-    assert set(closure) == {"a.h", "b.h"}
-
-
-def test_pch_checksum_survives_surrogate_extra(tmp_path: Path) -> None:
-    """Install paths from non-UTF-8 filesystems carry surrogates; hashing
-    them must not raise past the caller's identity-unknown guard."""
-    assert pch.pch_checksum(tmp_path, [], ["/opt/bad\udcff/framework"])
-
-
-def test_include_closure_walks_angle_includes_under_src(tmp_path: Path) -> None:
-    """An angle include resolving under src/ must enter the digest; one
-    that does not simply ends the walk."""
-    _write(tmp_path, "a.h", "#include <local.h>\n#include <Arduino.h>\n")
-    (tmp_path / "local.h").write_text("")
-    closure = pch._include_closure(tmp_path, ["a.h"])
-    assert set(closure) == {"a.h", "local.h"}
-
-
-def test_ccache_pch_env_warns_on_falsy_extsum(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    """A user CCACHE_PCH_EXTSUM=false makes ccache hash the .gch bytes."""
-    pch.mark_pch_emitted()
-    with patch.dict(os.environ, {"CCACHE_PCH_EXTSUM": "false"}, clear=True):
-        env = pch.ccache_pch_env()
-    assert "CCACHE_PCH_EXTSUM" not in env
-    assert "disables pch caching" in caplog.text
-
-
-@pytest.mark.parametrize(
-    ("value", "expected"),
-    [(None, False), ("0", False), ("1", True), ("true", True)],
-)
-def test_pch_strict(
-    value: str | None, expected: bool, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    if value is None:
-        monkeypatch.delenv("ESPHOME_PCH_STRICT", raising=False)
-    else:
-        monkeypatch.setenv("ESPHOME_PCH_STRICT", value)
-    assert pch.pch_strict() is expected
-
-
-def test_pch_degraded_raises_only_in_strict(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    from esphome.core import EsphomeError
-
-    monkeypatch.delenv("ESPHOME_PCH_STRICT", raising=False)
-    pch.pch_degraded("reason")
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "1")
-    with pytest.raises(EsphomeError, match="reason"):
-        pch.pch_degraded("reason")
-
-
-def test_pch_extra_scripts_strict_raises_when_disabled(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    from esphome.core import EsphomeError
-
-    monkeypatch.setenv("ESPHOME_PCH_ENABLE", "0")
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "1")
-    with pytest.raises(EsphomeError, match="disabled"):
-        pch.pch_extra_scripts()
-
-
-def test_pch_strict_rejects_unrecognized_values(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    """A typo must not silently disable the gate."""
-    from esphome.core import EsphomeError
-
-    monkeypatch.setenv("ESPHOME_PCH_STRICT", "yolo")
-    with pytest.raises(EsphomeError, match="Unrecognized ESPHOME_PCH_STRICT"):
-        pch.pch_strict()
-
-
-def test_discard_pch_raises_when_gch_survives(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """A .gch an unlink failure leaves behind would be consumed silently."""
-    from pathlib import Path as _P
-
-    from esphome.core import EsphomeError
-
-    (tmp_path / "esphome_pch.h").write_text("")
-    gch = tmp_path / "esphome_pch.h.gch"
-    gch.write_bytes(b"gch")
-    real_unlink = _P.unlink
-
-    def failing_unlink(self, missing_ok=False):
-        if self.name.endswith(".gch"):
-            raise OSError("readonly")
-        return real_unlink(self, missing_ok=missing_ok)
-
-    monkeypatch.setattr(_P, "unlink", failing_unlink)
-    with pytest.raises(EsphomeError, match="Could not discard"):
-        pch.discard_pch(tmp_path)
-
-
-def test_discard_pch_raises_when_sum_survives(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    """The .sum is ccache's pch identity; one that survives is as unsafe
-    as a surviving .gch."""
-    from pathlib import Path as _P
-
-    from esphome.core import EsphomeError
-
-    (tmp_path / "esphome_pch.h").write_text("")
-    (tmp_path / "esphome_pch.h.gch").write_bytes(b"gch")
-    (tmp_path / "esphome_pch.h.gch.sum").write_text("x")
-    real_unlink = _P.unlink
-
-    def failing_unlink(self, missing_ok=False):
-        if self.name.endswith(".sum"):
-            raise OSError("readonly")
-        return real_unlink(self, missing_ok=missing_ok)
-
-    monkeypatch.setattr(_P, "unlink", failing_unlink)
-    with pytest.raises(EsphomeError, match="Could not discard"):
-        pch.discard_pch(tmp_path)
-
-
-def test_discard_pch_warns_when_file_vanished_concurrently(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    """An unlink error on a file that is nonetheless gone only warns."""
-    from pathlib import Path as _P
-
-    (tmp_path / "esphome_pch.h").write_text("")
-    (tmp_path / "esphome_pch.h.gch").write_bytes(b"gch")
-    real_unlink = _P.unlink
-
-    def racing_unlink(self, missing_ok=False):
-        if self.name.endswith(".sum"):
-            # Racer removed it, then our unlink errored
-            raise OSError("stale handle")
-        return real_unlink(self, missing_ok=missing_ok)
-
-    monkeypatch.setattr(_P, "unlink", racing_unlink)
-    pch.discard_pch(tmp_path)
-    assert "Could not discard the pch sidecars" in caplog.text

tests/unit_tests/components/esp8266/test_toolchain_validation.py

@@ -1,193 +0,0 @@
-"""Tests for the native (non-PlatformIO) toolchain config validation."""
-
-from __future__ import annotations
-
-from collections.abc import Generator
-from pathlib import Path
-from types import SimpleNamespace
-from unittest.mock import patch
-
-import pytest
-
-from esphome.components import esp8266
-from esphome.components.esp8266 import (
-    ARDUINO_FRAMEWORK_SCHEMA,
-    _resolve_toolchain,
-    _validate_native_toolchain,
-)
-import esphome.config_validation as cv
-from esphome.const import (
-    CONF_BOARD,
-    CONF_FRAMEWORK,
-    CONF_PLATFORM_VERSION,
-    CONF_SOURCE,
-    CONF_TOOLCHAIN,
-    CONF_VERSION,
-    Toolchain,
-)
-from esphome.core import CORE, EsphomeError
-from esphome.types import ConfigType
-
-
-@pytest.fixture(autouse=True)
-def _arduino_toolchain() -> Generator[None]:
-    # The suite-wide reset_core fixture clears CORE.toolchain after each test
-    CORE.toolchain = Toolchain.ARDUINO
-    esp8266._DECODE_WARNED_AT.clear()
-    yield
-    esp8266._DECODE_WARNED_AT.clear()
-
-
-def _config(
-    board: str = "nodemcuv2",
-    version: str = "3.1.2",
-    source: str | None = None,
-    platform_version: str | None = None,
-) -> ConfigType:
-    framework: dict[str, str] = {CONF_VERSION: version}
-    if source is not None:
-        framework[CONF_SOURCE] = source
-    if platform_version is not None:
-        framework[CONF_PLATFORM_VERSION] = platform_version
-    # The real schema fills the source/platform_version defaults, so these
-    # tests validate against what config validation actually emits
-    return {
-        CONF_FRAMEWORK: ARDUINO_FRAMEWORK_SCHEMA(framework),
-        CONF_BOARD: board,
-    }
-
-
-def test_valid_config_passes() -> None:
-    config = _config()
-    assert _validate_native_toolchain(config) is config
-
-
-def test_platformio_toolchain_skips_checks() -> None:
-    # 3.0.2 is pio-legal (>= the global 3.0.0 floor) but below the native
-    # toolchain's own 3.1.1 floor; the bogus board only the native path checks
-    CORE.toolchain = Toolchain.PLATFORMIO
-    config = _config(board="not_a_board", version="3.0.2")
-    assert _validate_native_toolchain(config) is config
-
-
-def test_version_below_floor_rejected() -> None:
-    # 3.1.0 has no registry package, so the native floor is 3.1.1
-    with pytest.raises(cv.Invalid, match="3.1.1 or newer"):
-        _validate_native_toolchain(_config(version="3.1.0"))
-
-
-def test_version_at_floor_accepted() -> None:
-    _validate_native_toolchain(_config(version="3.1.1"))
-
-
-def test_custom_platform_version_warns_and_is_dropped(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    config = _config(platform_version="platformio/espressif8266@4.0.1")
-    _validate_native_toolchain(config)
-    assert "'platform_version' is ignored" in caplog.text
-    assert CONF_PLATFORM_VERSION not in config[CONF_FRAMEWORK]
-
-
-def test_default_platform_version_does_not_warn(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    config = _config()
-    _validate_native_toolchain(config)
-    assert "'platform_version' is ignored" not in caplog.text
-    assert CONF_PLATFORM_VERSION not in config[CONF_FRAMEWORK]
-
-
-def test_custom_source_rejected() -> None:
-    with pytest.raises(cv.Invalid, match="custom framework source"):
-        _validate_native_toolchain(
-            _config(source="https://github.com/esp8266/Arduino.git")
-        )
-
-
-def test_unsupported_board_rejected() -> None:
-    with pytest.raises(cv.Invalid, match="not supported by"):
-        _validate_native_toolchain(_config(board="not_a_board"))
-
-
-def test_yaml_toolchain_key_resolves() -> None:
-    """The documented `toolchain: arduino` YAML key selects the native path."""
-    CORE.toolchain = None
-    _resolve_toolchain({CONF_TOOLCHAIN: Toolchain.ARDUINO})
-    assert CORE.toolchain == Toolchain.ARDUINO
-    assert CORE.using_toolchain_arduino
-
-
-def test_yaml_toolchain_key_defaults_to_platformio() -> None:
-    CORE.toolchain = None
-    _resolve_toolchain({})
-    assert CORE.toolchain == Toolchain.PLATFORMIO
-
-
-def test_decode_pc_native_missing_tools_warns_once(
-    tmp_path: Path, caplog: pytest.LogCaptureFixture
-) -> None:
-    """A stack dump of many addresses produces one missing-tool warning."""
-
-    with (
-        patch(
-            "esphome.arduino8266.toolchain.get_addr2line_path",
-            return_value=tmp_path / "missing-addr2line",
-        ),
-        patch(
-            "esphome.arduino8266.toolchain.get_elf_path",
-            return_value=tmp_path / "missing.elf",
-        ),
-    ):
-        esp8266._decode_pc({}, "40201234")
-        esp8266._decode_pc({}, "40201238")
-    assert caplog.text.count("Cannot decode crash addresses") == 1
-
-
-def test_decode_pc_platformio_missing_tools_warns_once(
-    caplog: pytest.LogCaptureFixture,
-) -> None:
-    """The PlatformIO branch reports a missing addr2line/ELF at the same
-    warning level as the native one; raw undecoded addresses with no
-    stated reason are undiagnosable at default log level."""
-
-    CORE.toolchain = Toolchain.PLATFORMIO
-    idedata = SimpleNamespace(addr2line_path=None, firmware_elf_path=None)
-    with patch("esphome.platformio.toolchain.get_idedata", return_value=idedata):
-        esp8266._decode_pc({}, "40201234")
-        esp8266._decode_pc({}, "40201238")
-    assert caplog.text.count("Cannot decode crash addresses") == 1
-
-
-def test_resolve_toolchain_rejects_unsupported() -> None:
-    """ESP8266 rejects a CLI toolchain it cannot serve, like every platform."""
-
-    CORE.toolchain = Toolchain.SDK_NRF
-    with pytest.raises(cv.Invalid, match="Unsupported toolchain 'sdk-nrf'"):
-        _resolve_toolchain({})
-
-
-def test_run_compile_platformio_falls_through() -> None:
-    """Under toolchain: platformio the hook returns False without touching
-    the native backend; this is what keeps existing users on PlatformIO."""
-    CORE.toolchain = Toolchain.PLATFORMIO
-    with patch("esphome.arduino8266.toolchain.run_compile") as mock_native:
-        assert esp8266.run_compile(SimpleNamespace(), {}) is False
-    mock_native.assert_not_called()
-
-
-def test_run_compile_arduino_failure_raises() -> None:
-    """A non-zero native build fails by name instead of returning success."""
-    CORE.verbose = False
-    with (
-        patch("esphome.arduino8266.toolchain.run_compile", return_value=1),
-        pytest.raises(EsphomeError, match="native build failed"),
-    ):
-        esp8266.run_compile(SimpleNamespace(), {})
-
-
-def test_copy_files_native_skips_platformio_scripts(tmp_path: Path) -> None:
-    """The native build writes no PlatformIO extra scripts."""
-    CORE.build_path = tmp_path
-    esp8266.copy_files()
-    assert list(tmp_path.iterdir()) == []

tests/unit_tests/core/test_config.py

@@ -1429,3 +1429,12 @@ async def test_add_platformio_options_native_arduino(
     assert "board_build.ldscript is ignored" in caplog.text
     assert "'arduino' toolchain" in caplog.text
     assert "upload_speed" not in caplog.text
+
+
+def test_esp8266_rejects_unsupported_cli_toolchain() -> None:
+    """Until the native backend lands, ESP8266 serves only PlatformIO."""
+    from esphome.components.esp8266 import CONFIG_SCHEMA
+
+    CORE.toolchain = Toolchain.ARDUINO
+    with pytest.raises(cv.Invalid, match="Unsupported toolchain 'arduino'"):
+        CONFIG_SCHEMA({"board": "nodemcuv2"})